CVE-2026-4091

OVERVIEW: CVE-2026-4091 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the OPEN-BRAIN plugin for WordPress in all versions up to and including 0.5.0. The vulnerability exists in the func_page_main() function due to missing nonce verification on the settings form, allowing attackers to inject malicious web scripts through forged requests if they can manipulate site administrators into clicking malicious links. SEVERITY: The vulnerability carries a CVSS score of 6.1 (Medium) with a network-based attack vector requiring low complexity and no elevated privileges. However, successful exploitation requires user interaction (UI:R), as the attacker must trick an administrator into performing an action. The impact is limited to low-level confidentiality and integrity compromise with no availability impact. EXPLOITATION STATUS: There is currently no evidence of active exploitation in the wild. The vulnerability does not appear on the Known Exploited Vulnerabilities (KEV) catalog and remains inactive on threat intelligence hot lists. The EPSS score of 0.000290 indicates this threat ranks lower than the vast majority of CVEs in terms of predicted exploitation probability, though organizations running affected OPEN-BRAIN versions should still apply patches to eliminate this CSRF vector.