PT-2026-34296 · Chsxf · Mcatfilter

Muhammad Afnaan · Published 2026-04-22 · Updated 2026-04-22 · CVE-2026-4139

NVD

CVSS v3.1

4.3

Medium

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

The mCatFilter plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 0.5.2. This is due to the complete absence of nonce verification and capability checks in the compute post() function, which processes settings updates. The compute post() function is called in the plugin constructor on every page load via the plugins loaded hook, and it directly processes $ POST data to modify plugin settings via update option() without any CSRF token validation. This makes it possible for unauthenticated attackers to modify all plugin settings, including category exclusion rules, feed exclusion flags, and tag page exclusion flags, via a forged POST request, granted they can trick a site administrator into performing an action such as clicking a link.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2026-4139

Affected Products

Mcatfilter

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-4139 · Security Note
• https://plugins.trac.wordpress.org/browser/mcatfilter/tags/0.5.2/mcatfilter.php#L339 · Note
• https://plugins.trac.wordpress.org/browser/mcatfilter/tags/0.5.2/mcatfilter.php#L320 · Note
• https://plugins.trac.wordpress.org/browser/mcatfilter/trunk/mcatfilter.php#L339 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/622ee6c8-7739-44ae-b88f-63a93c0a9b20?source=cve · Note
• https://plugins.trac.wordpress.org/browser/mcatfilter/trunk/mcatfilter.php#L320 · Note
• https://plugins.trac.wordpress.org/browser/mcatfilter/trunk/mcatfilter.php#L138 · Note
• https://plugins.trac.wordpress.org/browser/mcatfilter/tags/0.5.2/mcatfilter.php#L138 · Note