Exploit discussion active in current signal (2 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
The Inquiry Cart plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.4.2. This is due to missing nonce verification in the rd_ic_settings_page function when processing settings form submissions. This makes it possible for unauthenticated attackers to update the plugin's settings, including injecting malicious scripts that will be stored and executed in the admin area, via a forged request granted they can trick an administrator into performing an action such as clicking on a link.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
CVE-2026-4090 The Inquiry Cart plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.4.2. This is due to missing nonce verification… https://www.cve.org/CVERecord?id=CVE-2026-4090
Post summary
The Inquiry Cart plugin for WordPress is vulnerable to CSRF attacks caused by missing nonce verification in all versions up to 3.4.2.
https://atomicedge.io/cve-proof/cve-2026-4090-inquiry-cart-version-3-4-2-medium-vulnerability-proof-of-concept CVE-2026-4090 #WordPress plugin #vulnerability inquiry-cart #cybersecurity #wordpressfirewall #wordpresssecurity #hacking #wpsecurity #atomicedge
Post summary
The post advertises a proof‑of‑concept exploit for CVE‑2026‑4090 targeting the Inquiry‑Cart WordPress plugin (v3.4.2), indicating a medium‑severity vulnerability, but offers no evidence of active exploitation or any mitigation.