mCatFilter <= 0.5.2 - Cross-Site Request Forgery via compute_post() Function

The core of the vulnerability lies within the computepost() function, which directly processes $POST data to update plugin settings using updateoption() without any CSRF token validation. Because this function is called on every page load via the pluginsloaded hook, an attacker can craft malicious requests to modify any plugin setting. This could involve altering category mappings, changing display options, or even disabling security features, effectively compromising the website's configuration. The lack of authentication checks means an unauthenticated attacker can perform these actions. The potential impact extends beyond simple configuration changes; an attacker could leverage modified settings to inject malicious content or redirect users to phishing sites, escalating the attack.

1. Réservé2026-03-13
2. Publiée2026-04-21
3. Modifiée2026-04-22
4. EPSS mis à jour2026-04-29

The primary mitigation for CVE-2026-4139 is to upgrade to a patched version of the mCatFilter plugin. Unfortunately, a fixed version is not explicitly mentioned in the CVE details. As a temporary workaround, consider implementing a Web Application Firewall (WAF) rule to filter requests to the computepost() function, specifically looking for suspicious $POST data patterns. Another approach is to restrict access to the plugin's settings page using WordPress's role-based access control, limiting who can modify the settings. After upgrading (or implementing a workaround), verify the plugin's settings have not been altered by reviewing the configuration and testing key functionalities.

Installations actives

20Niche

Note du plugin