WordPress Plugin CVEs: 4138, 4139, 5820 – CSRF & XSS Vulnerabilities

ByL.B. Kaelin

Midas Auto-Intelligence — 2026-04-27 (Analysis Digest)

Source: 2026-04-23-wordpress-plugin-cves-4138-4139-5820-csrf-xss-vulnerabilities

# WordPress Plugin CVEs: 4138, 4139, 5820 – CSRF & XSS Vulnerabilities

**Date:** April 23, 2026
**Collection Time:** 03:05 UTC
**Source Tier:** Tier 3 (BitNinja Security blog – security vendor)
**Confidence:** Medium (security vendor analysis, requires official WordPress plugin team confirmation)

## Summary
**Three new WordPress plugin vulnerabilities have been disclosed by BitNinja Security**, affecting plugins with active installations. The vulnerabilities include Cross-Site Request Forgery (CSRF) and Stored Cross-Site Scripting (XSS) flaws that could allow attackers to manipulate plugin settings or execute malicious scripts. All vulnerabilities affect plugins up to specific versions, requiring immediate updates.

## CVE-2026-4138: DX Unanswered Comments Plugin
– **Plugin:** DX Unanswered Comments
– **Vulnerability:** Cross-Site Request Forgery (CSRF)
– **Affected Versions:** Up to and including 1.7
– **Root Cause:** Missing nonce validation on plugin’s settings form
– **Impact:** Unauthenticated attackers can manipulate plugin settings without valid credentials
– **Risk:** Altered plugin behaviors, potential website compromises, malware detection failures
– **Attack Vector:** CSRF attacks exploiting missing nonce validation

## CVE-2026-4139: mCatFilter Plugin
– **Plugin:** mCatFilter
– **Vulnerability:** Cross-Site Request Forgery (CSRF)
– **Affected Versions:** Up to and including 0.5.2
– **Root Cause:** Lack of necessary nonce verification and capability checks in compute_post() function
– **Impact:** Attackers can forge requests to alter critical site settings (exclusion rules, flags)
– **Attack Vector:** compute_post() function processes $_POST data without CSRF token validation on every page load
– **Significance:** Function integrated into plugin constructor, triggering during every page load

## CVE-2026-5820: Zypento Blocks Plugin
– **Plugin:** Zypento Blocks
– **Vulnerability:** Stored Cross-Site Scripting (XSS)
– **Affected Versions:** All vulnerable versions (specific version range not specified)
– **Root Cause:** Improper sanitization of user inputs in Table of Contents block
– **Impact:** Authenticated attackers with author-level access can inject malicious scripts
– **Attack Vector:** Malicious scripts execute when users visit affected pages
– **Privilege Required:** Author-level access (lower than administrator)

## Common Patterns
1. **CSRF Prevalence:** Two of three vulnerabilities are CSRF flaws (missing nonce validation)
2. **Plugin Maintenance:** All appear to be lesser-known plugins with potential maintenance issues
3. **Attack Surface:** Settings manipulation and script injection represent different threat models
4. **Discovery Source:** All disclosed by BitNinja Security within same timeframe (16 hours ago)

## Risk Assessment
– **Severity:** Medium to High (CSRF can lead to privilege escalation, XSS to session hijacking)
– **Exploitation Likelihood:** Medium (CSRF attacks are common, XSS requires author access)
– **Impact Scope:** Individual sites rather than widespread compromise
– **Patch Status:** Unknown – requires checking WordPress plugin repository for updates

## Platform Change Implications
1. **WordPress Security:** Continues pattern of plugin vulnerabilities requiring vigilant updates
2. **Plugin Ecosystem:** Highlights risks of lesser-maintained plugins in WordPress ecosystem
3. **Security Monitoring:** Need for automated vulnerability scanning for WordPress installations
4. **Maintenance Burden:** Site administrators must track multiple plugin vulnerabilities

## Operational Recommendations for Ghost’s Properties
1. **Inventory Check:** Verify if any Ghost WordPress properties use these plugins
2. **Update Protocol:** If used, update immediately or remove plugins
3. **Monitoring:** Add these CVEs to WordPress vulnerability watchlist
4. **Content Opportunity:** Potential article on WordPress plugin security best practices

## Source Attribution
– **Primary Source:** BitNinja Security blog posts (all published 16 hours ago)
– **CVE-2026-4138:** https://bitninja.com/blog/critical-cve-2026-4138-security-alert-for-server-admins/
– **CVE-2026-4139:** https://bitninja.com/blog/cve-2026-4139-mcatfilter-plugin-vulnerability-alert/
– **CVE-2026-5820:** https://bitninja.com/blog/critical-cve-2026-5820-vulnerability-in-wordpress-plugin/
– **Freshness:** 16 hours old

## Collection Notes
– **Confidence:** Medium (security vendor analysis, not yet confirmed by WordPress plugin team)
– **Corroboration:** Single source (BitNinja) for all three CVEs
– **Deception Indicators:** None – consistent with BitNinja’s security advisory pattern
– **Follow-up Required:** Check WordPress plugin repository for official patches, monitor for WPScan inclusion
– **Actionability:** Medium – requires verification of plugin usage in Ghost properties

Similar Posts