CVE-2026-9732

Vulnerability

The EmergencyWP plugin for WordPress, in all versions up to and including 1.4.2, suffers from a Cross-Site Request Forgery vulnerability. This is due to insufficient nonce validation within the form_settings_ui function, which handles saving plugin settings. The vulnerability is present in the procedural include scope of this function.

Exploitation

An unauthenticated attacker can exploit this vulnerability by crafting a malicious request, typically via a link, and tricking a site administrator into interacting with it. This interaction triggers the forged request, allowing the attacker to modify plugin settings without proper authorization.

Impact

Successful exploitation allows an unauthenticated attacker to modify critical plugin settings. This includes altering the minimum access role, the data-erasure-on-uninstall flag, life-check timing, the mandator email address, the confirmation page ID, and date/time formats. Modifying role capabilities can lead to privilege escalation.

Mitigation

The EmergencyWP plugin has been closed and removed from the WordPress.org plugin directory as of May 29, 2026, due to an author request [4]. No patched version will be distributed through the official directory. Users who have this plugin installed should uninstall it immediately. As the plugin is no longer available, there are no further updates or official workarounds.