CVE-2026-4002 is a CSRF vulnerability in the Petje.af WordPress plugin affecting all versions up to 2.1.8. The issue arises because the ajax_revoke_token() function, which processes the 'petjeaf_disconnect' AJAX action, lacks nonce validation to verify the legitimacy of the request source. This flaw allows attackers to perform unauthorized destructive actions, including revoking OAuth2 tokens, deleting user metadata, and removing WordPress user accounts assigned the 'petjeaf_member' role, by tricking authenticated users into executing forged requests.

Exploitation of this vulnerability can lead to unauthorized deletion of Petje.af member user accounts and associated data for authenticated users. While it does not directly compromise confidentiality or availability broadly, it results in loss of user accounts and related OAuth2 tokens, causing disruption to affected users. The CVSS score of 4.3 reflects a medium impact primarily on integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the Petje.af plugin or restricting access to the affected AJAX action to trusted users only. Monitoring for suspicious activity related to account deletions is advisable. Avoid clicking on untrusted links while authenticated to WordPress sites using this plugin.