The mCatFilter WordPress plugin accepts settings updates through its compute_post() function without any nonce verification or capability checks. The function is called on every page load and processes raw POST data to modify plugin settings via update_option(). Consequently, an unauthenticated attacker can send a forged POST request that a site administrator unknowingly executes, allowing the attacker to alter plugin settings such as category exclusions, feed flags, and tag page exclusions. The impact is the compromise of the plugin’s configuration integrity, which can affect content visibility and site functionality.

All installations of the mCatFilter plugin for WordPress up to and including version 0.5.2 are affected. Administrators using any WordPress site with these plugin versions are at risk.

This vulnerability carries a CVSS score of 4.3, indicating medium severity. EPSS information is not available, so the exploitation probability cannot be quantified. The issue is not listed in the CISA KEV catalog. The likely attack requires a victim administrator to click a malicious link that submits a crafted POST request; thus the attack vector is web-based user interaction. While it does not provide remote code execution, the ability to hijack configuration settings can lead to unintentional content exclusion, possible compliance violations, and reduced control over the site’s behavior.