CVE-2026-4090 is a Cross-Site Request Forgery vulnerability in the Inquiry Cart WordPress plugin caused by missing nonce verification in the rd_ic_settings_page function. This flaw allows attackers to perform unauthorized changes to plugin settings by tricking an admin user into submitting a malicious request. The vulnerability affects all versions up to 3.4.2 and can lead to stored script injection within the admin interface. The CVSS 3.1 base score is 6.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope change, and low confidentiality and integrity impacts.

An attacker can exploit this vulnerability to modify plugin settings without authentication by leveraging an administrator's interaction, such as clicking a crafted link. This can result in stored malicious scripts executing in the WordPress admin area, potentially compromising administrative functions and data confidentiality and integrity. There is no indication of availability impact or known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should exercise caution when interacting with untrusted links and consider restricting access to the plugin settings page. Monitoring for plugin updates from the vendor is recommended to apply any forthcoming patches promptly.