CVE-2026-4139 describes a CSRF vulnerability in the mCatFilter WordPress plugin (versions up to 0.5.2). The compute_post() function, invoked on every page load via the plugins_loaded hook, processes $_POST data to update plugin settings without nonce or capability checks. This lack of CSRF token validation enables attackers to forge POST requests that modify plugin settings such as category exclusion rules and feed exclusion flags by tricking an administrator into performing an action like clicking a malicious link.

An attacker can cause an authenticated administrator to unknowingly modify all plugin settings by exploiting the absence of CSRF protections. This can lead to unauthorized changes in category and feed exclusion rules, potentially affecting site content filtering behavior. There is no direct confidentiality or availability impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should exercise caution when clicking links and consider disabling or removing the vulnerable plugin if possible. Implementing web application firewall (WAF) rules to block suspicious POST requests targeting the plugin's settings endpoint may provide temporary mitigation.