CVE-2026-4002

BRIEFING NOTE - CVE-2026-4002 The Petje.af plugin for WordPress versions up to 2.1.8 contains a Cross-Site Request Forgery (CSRF) vulnerability in the ajax_revoke_token() AJAX function. The vulnerability stems from missing nonce validation, allowing unauthenticated attackers to forge requests that perform destructive operations including revoking OAuth2 tokens, deleting user metadata, and removing WordPress user accounts assigned the 'petjeaf_member' role. The vulnerability carries a CVSS 3.1 score of 4.3 (Medium), reflecting a network-based attack vector with low complexity and no elevated privileges required. However, exploitation requires user interaction, as victims must click a malicious link or visit a compromised website. The impact is limited to integrity compromise and account deletion, with no confidentiality or availability concerns noted. Current exploitation status indicates this is not an active threat. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog and does not appear on any active exploitation watch lists. The EPSS score of 0.00016 ranks this vulnerability below the 0.035 percentile, suggesting minimal community attention and low real-world exploit likelihood. No public exploit code availability has been reported.