CVE-2026-4139 identifies a CSRF vulnerability in the mCatFilter plugin for WordPress versions up to 0.5.2. The compute_post() function, invoked on every page load via the plugins_loaded hook, processes $_POST data to update plugin settings using update_option() without any nonce or capability verification. This lack of CSRF token validation enables unauthenticated attackers to modify all plugin settings by tricking an administrator into performing an action such as clicking a malicious link. The vulnerability is classified under CWE-352 and has a CVSS 3.1 base score of 4.3, indicating medium severity.

An attacker can cause an authenticated administrator to unknowingly submit a forged POST request that modifies all settings of the mCatFilter plugin, including category exclusion rules and feed exclusion flags. This could alter the behavior of the plugin in unintended ways but does not directly impact confidentiality or availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid clicking untrusted links while logged into WordPress sites using the mCatFilter plugin. Implementing manual nonce verification or disabling the plugin temporarily may reduce risk.