CVE-2026-27090 is a CSRF vulnerability affecting the WP Moose Kenta Companion plugin for WordPress, specifically versions up to 1.3.3. The vulnerability allows attackers to trick authenticated users into submitting unauthorized requests, potentially leading to limited integrity impact. The CVSS vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, low integrity impact, and no availability impact. No vendor advisory or patch information is available to confirm remediation status.

The vulnerability could allow an attacker to perform unauthorized actions on behalf of an authenticated user, affecting the integrity of the affected system. There is no impact on confidentiality or availability. No known exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider implementing CSRF protections such as verifying nonces or tokens in requests if possible, or limiting user permissions to reduce risk.