Inquiry cart <= 3.4.2 - 设置表单中的跨站请求伪造漏洞

The primary impact of CVE-2026-4090 lies in the attacker's ability to modify the Inquiry Cart plugin's configuration. By crafting a forged request and tricking an administrator into clicking a malicious link, an attacker can inject arbitrary scripts. These scripts could then be stored and executed within the WordPress admin interface, granting the attacker persistent access and control. This could lead to defacement, data theft, or further compromise of the WordPress installation. The blast radius extends to any sensitive data accessible through the WordPress admin panel, and potentially to other connected systems if the WordPress site is part of a larger infrastructure.

1. 已保留2026-03-12
2. 发布日期2026-04-21
3. 修改日期2026-04-22
4. EPSS 更新日期2026-04-29

The immediate mitigation for CVE-2026-4090 is to upgrade the Inquiry Cart plugin to a version that addresses the XSRF vulnerability. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) with XSRF protection rules to filter out malicious requests. Additionally, enforce strict access controls and regularly audit user permissions within the WordPress admin area. While a direct detection signature is not readily available, monitoring for unusual plugin setting changes in WordPress logs could provide an early warning sign. After upgrade, confirm by reviewing the plugin's changelog and verifying that nonce verification is properly implemented in the settings form submissions.

活跃安装数

10

插件评分