CVE-2026-4091 describes a CSRF vulnerability in the OPEN-BRAIN WordPress plugin (versions up to 0.5.0) caused by the absence of nonce verification in the func_page_main() function's settings form. This security flaw allows attackers to forge requests that an authenticated administrator might unknowingly execute, potentially injecting malicious web scripts or altering settings. The vulnerability is rated medium severity with a CVSS 3.1 base score of 6.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and partial impact on confidentiality and integrity. No patch or official remediation level has been published by the vendor as of the data provided.

An attacker can exploit this vulnerability by tricking an authenticated site administrator into submitting a forged request, which could lead to unauthorized changes in the plugin's settings or injection of malicious scripts. The impact is limited to confidentiality and integrity, with no direct availability impact reported. Since the attacker does not need privileges but requires user interaction, the risk depends on administrator behavior. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should exercise caution when interacting with untrusted links or websites. Implementing manual nonce verification or other CSRF protections in the plugin code could mitigate the risk if feasible. Monitoring for updates from the vendor is recommended.