CVE-2026-4139

The mCatFilter plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 0.5.2. This is due to the complete absence of nonce verification and capability checks in the compute_post() function, which processes settings updates. The compute_post() function is called in the plugin constructor on every page load via the plugins_loaded hook, and it directly processes $_POST data to modify plugin settings via update_option() without any CSRF token validation. This makes it possible for unauthenticated attackers to modify all plugin settings, including category exclusion rules, feed exclusion flags, and tag page exclusion flags, via a forged POST request, granted they can trick a site administrator into performing an action such as clicking a link.

• CWE-352

• https://plugins.trac.wordpress.org/browser/mcatfilter/tags/0.5.2/mcatfilter.php#L138
• https://plugins.trac.wordpress.org/browser/mcatfilter/tags/0.5.2/mcatfilter.php#L320
• https://plugins.trac.wordpress.org/browser/mcatfilter/tags/0.5.2/mcatfilter.php#L339
• https://plugins.trac.wordpress.org/browser/mcatfilter/trunk/mcatfilter.php#L138
• https://plugins.trac.wordpress.org/browser/mcatfilter/trunk/mcatfilter.php#L320
• https://plugins.trac.wordpress.org/browser/mcatfilter/trunk/mcatfilter.php#L339
• https://www.wordfence.com/threat-intel/vulnerabilities/id/622ee6c8-7739-44ae-b88f-63a93c0a9b20?source=cve

Published

Apr 22, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-41384OpenClaw before 2026.3.24 contains an environment variable i…8.5
• CVE-2026-41385OpenClaw before 2026.3.31 stores Nostr privateKey as plainte…7.1
• CVE-2026-41386OpenClaw before 2026.3.22 contains a privilege escalation vu…9.8
• CVE-2026-41387OpenClaw before 2026.3.22 contains an incomplete host enviro…8.5
• CVE-2026-41388OpenClaw before 2026.3.31 contains a configuration managemen…6.5
• CVE-2026-41389OpenClaw versions 2026.4.7 before 2026.4.15 fail to enforce …6.3
• CVE-2026-41390OpenClaw before 2026.3.28 contains an exec allowlist bypass …7.3
• CVE-2026-41391OpenClaw before 2026.3.31 fails to properly sanitize PIP_IND…6.1
• CVE-2026-41392OpenClaw before 2026.3.31 contains an exec allowlist bypass …7.3
• CVE-2026-41393OpenClaw before 2026.3.31 contains a wide-area discovery vul…4.8
• CVE-2026-41394OpenClaw before 2026.3.31 contains an authentication bypass …8.8
• CVE-2026-41395OpenClaw before 2026.3.28 contains a webhook replay vulnerab…8.2