Inquiry cart <= 3.4.2 - Cross-Site Request Forgery via Settings Form

The primary impact of this CSRF vulnerability lies in the ability of an attacker to modify the Inquiry Cart plugin's configuration without authentication. By crafting a malicious request and tricking an administrator into clicking a link or visiting a compromised page, an attacker can inject arbitrary scripts into the plugin's settings. These scripts could then be executed whenever an administrator accesses the plugin's admin interface, potentially leading to account compromise, data theft, or further malicious activity on the WordPress site. The blast radius extends to any sensitive data handled by the Inquiry Cart plugin, as attackers could leverage injected scripts to exfiltrate or modify this information. This vulnerability shares similarities with other CSRF exploits where user interaction is required to trigger the attack.

1. Reserviert2026-03-12
2. Veröffentlicht2026-04-21
3. Geändert2026-04-22
4. EPSS aktualisiert2026-04-29

The immediate mitigation for CVE-2026-4090 is to upgrade the Inquiry Cart plugin to a version that addresses the CSRF vulnerability. The vendor has not yet released a fixed version, so monitor their website for updates. As a temporary workaround, implement strict Content Security Policy (CSP) headers to restrict the execution of inline scripts and external resources. Additionally, consider using a WordPress security plugin that provides CSRF protection for plugins. Regularly review plugin settings and user permissions to identify any unauthorized changes. After upgrading, verify the plugin's settings and functionality to ensure proper operation.

Aktive Installationen

10

Plugin-Bewertung