CVE-2026-4090

The Inquiry Cart plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.4.2. This is due to missing nonce verification in the rd_ic_settings_page function when processing settings form submissions. This makes it possible for unauthenticated attackers to update the plugin's settings, including injecting malicious scripts that will be stored and executed in the admin area, via a forged request granted they can trick an administrator into performing an action such as clicking on a link.

• CWE-352

• https://plugins.trac.wordpress.org/browser/inquiry-cart/tags/0.0.0.0/includes/inquiry-cart-shortcode.php#L32
• https://plugins.trac.wordpress.org/browser/inquiry-cart/tags/0.0.0.0/includes/inquiry-cart-shortcode.php#L34
• https://plugins.trac.wordpress.org/browser/inquiry-cart/tags/0.0.0.0/includes/settings-page.php#L21
• https://plugins.trac.wordpress.org/browser/inquiry-cart/tags/0.0.0.0/includes/settings-page.php#L46
• https://plugins.trac.wordpress.org/browser/inquiry-cart/tags/0.0.0.0/includes/settings-page.php#L47
• https://plugins.trac.wordpress.org/browser/inquiry-cart/tags/0.0.0.0/includes/settings-page.php#L48
• https://plugins.trac.wordpress.org/browser/inquiry-cart/tags/0.0.0.0/includes/settings-page.php#L49
• https://plugins.trac.wordpress.org/browser/inquiry-cart/tags/0.0.0.0/includes/settings-page.php#L6
• https://plugins.trac.wordpress.org/browser/inquiry-cart/trunk/includes/inquiry-cart-shortcode.php#L32
• https://plugins.trac.wordpress.org/browser/inquiry-cart/trunk/includes/inquiry-cart-shortcode.php#L34
• https://plugins.trac.wordpress.org/browser/inquiry-cart/trunk/includes/settings-page.php#L21
• https://plugins.trac.wordpress.org/browser/inquiry-cart/trunk/includes/settings-page.php#L46
• https://plugins.trac.wordpress.org/browser/inquiry-cart/trunk/includes/settings-page.php#L47
• https://plugins.trac.wordpress.org/browser/inquiry-cart/trunk/includes/settings-page.php#L48
• https://plugins.trac.wordpress.org/browser/inquiry-cart/trunk/includes/settings-page.php#L49
• https://plugins.trac.wordpress.org/browser/inquiry-cart/trunk/includes/settings-page.php#L6
• https://www.wordfence.com/threat-intel/vulnerabilities/id/772e9b2b-b2d5-4950-804b-d0914004710c?source=cve

Published

Apr 22, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-40894OpenTelemetry dotnet is a dotnet telemetry framework. In Ope…5.3
• CVE-2026-40895follow-redirects is an open source, drop-in replacement for …7.5
• CVE-2026-40896OpenProject is open-source, web-based project management sof…7.1
• CVE-2026-40897Math.js is an extensive math library for JavaScript and Node…8.8
• CVE-2026-40898quic-go is an implementation of the QUIC protocol in Go. Pri…7.5
• CVE-2026-40899DataEase is an open-source data visualization and analytics …6.5
• CVE-2026-40900DataEase is an open-source data visualization and analytics …8.8
• CVE-2026-40901DataEase is an open-source data visualization and analytics …8.8
• CVE-2026-40902PhpSpreadsheet is a pure PHP library for reading and writing…7.5
• CVE-2026-40903goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-be…9.1
• CVE-2026-40904Chartbrew is an open-source web application that can connect…8.1
• CVE-2026-40905LinkAce is a self-hosted archive to collect website links. P…8.1