CVE-2026-4139: mCatFilter WordPress Plugin CSRF Vulnerability

CVE-2026-4139 Overview

The mCatFilter plugin for WordPress contains a Cross-Site Request Forgery (CSRF) vulnerability affecting all versions up to and including 0.5.2. This security flaw stems from the complete absence of nonce verification and capability checks in the compute_post() function, which is responsible for processing settings updates. The vulnerable function is called in the plugin constructor on every page load via the plugins_loaded hook and directly processes $_POST data to modify plugin settings through update_option() without any CSRF token validation.

Critical Impact

Unauthenticated attackers can modify all mCatFilter plugin settings, including category exclusion rules, feed exclusion flags, and tag page exclusion flags, by tricking a site administrator into clicking a malicious link.

Affected Products

• mCatFilter WordPress Plugin version 0.5.2 and earlier
• WordPress sites with mCatFilter installed
• All WordPress deployments using vulnerable mCatFilter versions

Discovery Timeline

• 2026-04-22 - CVE-2026-4139 published to NVD
• 2026-04-22 - Last updated in NVD database

Technical Details for CVE-2026-4139

Vulnerability Analysis

This CSRF vulnerability exists because the mCatFilter plugin fails to implement fundamental WordPress security mechanisms. The compute_post() function processes settings changes without verifying that the request originated from a legitimate administrator session. WordPress provides nonce tokens specifically to prevent CSRF attacks, but the plugin authors neglected to implement this protection entirely.

The vulnerability is particularly concerning because compute_post() is invoked during the plugins_loaded action hook, which fires on every WordPress page load. This means the vulnerable code path is always active whenever the plugin is enabled, creating a persistent attack surface. An attacker only needs to craft a malicious HTML page containing a hidden form that submits POST data to the target WordPress site.

Root Cause

The root cause of CVE-2026-4139 is the absence of both nonce verification and capability checks in the settings processing logic. WordPress best practices dictate that any function modifying options should:

1. Verify a valid nonce token using wp_verify_nonce() or check_admin_referer()
2. Confirm the user has appropriate capabilities using current_user_can()

The compute_post() function skips both of these critical checks, directly processing $_POST data and calling update_option() to persist changes to the database. This allows any HTTP POST request to the WordPress site to potentially modify plugin settings if the request is made in the context of an authenticated administrator's browser session.

Attack Vector

An attacker exploits this vulnerability through a network-based attack requiring user interaction. The typical attack flow involves:

1. The attacker creates a malicious webpage containing a hidden HTML form that targets the victim's WordPress site
2. The form is pre-populated with POST parameters that correspond to the mCatFilter settings fields
3. The attacker social-engineers a WordPress administrator into visiting the malicious page
4. Upon page load, JavaScript automatically submits the hidden form, or the victim is tricked into clicking a button
5. The administrator's browser sends the POST request with their authenticated session cookies
6. The compute_post() function processes the malicious POST data without CSRF validation
7. Plugin settings are modified according to the attacker's payload

The vulnerable code can be examined in the WordPress Plugin Code Reference and related source files at line 320 and line 339.

Detection Methods for CVE-2026-4139

Indicators of Compromise

• Unexpected changes to mCatFilter plugin settings without administrator action
• Modified category exclusion rules, feed exclusion flags, or tag page exclusion settings
• HTTP POST requests to WordPress pages originating from external referrers
• Administrator reports of clicking suspicious links prior to settings changes

Detection Strategies

• Monitor WordPress wp_options table for unexpected modifications to mCatFilter-related options
• Review web server access logs for POST requests to WordPress pages with external or suspicious Referer headers
• Implement Content Security Policy headers to restrict form submission targets
• Deploy web application firewall rules to detect CSRF attack patterns

Monitoring Recommendations

• Enable WordPress audit logging to track all plugin settings changes with user attribution
• Configure alerts for option modifications occurring outside of the WordPress admin dashboard context
• Regularly review mCatFilter settings to ensure they match expected configurations
• Monitor for suspicious administrator activity patterns that may indicate successful CSRF exploitation

How to Mitigate CVE-2026-4139

Immediate Actions Required

• Check if a patched version of mCatFilter is available and update immediately
• If no patch is available, consider temporarily deactivating the mCatFilter plugin until a fix is released
• Review current mCatFilter settings to identify any unauthorized modifications
• Educate site administrators about the risks of clicking untrusted links while logged into WordPress

Patch Information

Review the Wordfence Vulnerability Report for the latest patch status and remediation guidance. Monitor the plugin's WordPress repository for updated versions that include proper nonce verification and capability checks in the compute_post() function.

Workarounds

• Implement a web application firewall rule to block POST requests to WordPress from external referrers
• Use browser extensions or security headers to prevent cross-origin form submissions to the WordPress admin
• Limit WordPress administrator access to trusted IP addresses to reduce the attack surface
• Consider using alternative category filtering plugins with proper CSRF protection until a patch is available

# Add to .htaccess to block POST requests with external referrers (Apache)
RewriteEngine On
RewriteCond %{REQUEST_METHOD} POST
RewriteCond %{HTTP_REFERER} !^https?://(www\.)?yourdomain\.com [NC]
RewriteCond %{REQUEST_URI} !^/wp-(cron|trackback)\.php [NC]
RewriteRule ^ - [F,L]