CVE-2026-9732: EmergencyWP CSRF Vulnerability—Plugin Settings Modification Risk

Technical summary

CVE-2026-9732 is a Cross-Site Request Forgery (CWE-352) vulnerability in the EmergencyWP plugin affecting all versions through 1.4.2. The flaw exists in the form_settings_ui function, which handles settings persistence but lacks proper nonce validation. This allows an attacker to craft a forged HTTP request that, when executed by an authenticated administrator, modifies sensitive plugin configuration including role capabilities (via WordPress add_cap/remove_cap functions), data-erasure-on-uninstall flags, life-check timing parameters, administrator email addresses, confirmation page IDs, and date/time format settings. The attack requires social engineering to trick an admin into visiting an attacker-controlled page or clicking a malicious link.

Business impact

Compromised plugin settings can degrade the intended security and functionality of the legacy data management workflow that EmergencyWP provides. Unauthorized modification of administrator email addresses could disrupt critical notifications or lock legitimate administrators out of the system. Changes to access role capabilities could grant unintended privileges to lower-privileged users or restrict legitimate administrators. For organizations relying on EmergencyWP for digital legacy management or data-erasure orchestration, a successful attack could undermine trust in the plugin's configuration integrity and require administrative investigation and remediation.

Affected systems

WordPress installations using the EmergencyWP – Dead Man's switch & legacy deliverance plugin in versions 1.4.2 and earlier are affected. The vulnerability does not affect the WordPress core or other plugins; exposure is limited to sites with EmergencyWP installed and active. The attack surface is limited to WordPress administrators, since the forged request must be executed by a user with settings-modification capability.

Exploitability

This vulnerability has a CVSS 3.1 score of 4.3 (MEDIUM severity) with a network attack vector and low complexity, but requires user interaction (UI:R). Exploitation is straightforward from a technical standpoint—crafting a forged request is trivial—but depends entirely on social engineering. An attacker must convince an administrator to click a link or visit a compromised page while logged into WordPress. There is no authenticated exploit path, and the attack leaves a minimal forensic footprint unless request logging is enabled. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) reflects that impact is limited to integrity of settings, with no confidentiality or availability impact.

Remediation

Update the EmergencyWP plugin to a patched version that implements proper nonce validation on the form_settings_ui function. Verify the patched version number against the official WordPress plugin repository or the plugin vendor's advisory. In the interim, restrict plugin settings access to trusted administrators only, educate administrators about CSRF phishing tactics, and monitor settings change logs for unauthorized modifications.

Patch guidance

Check the WordPress plugin repository (plugins.wordpress.org) or contact the plugin vendor directly for the patched version release date and number. Apply the update as soon as it becomes available. Verify the update in your WordPress admin dashboard under Plugins > Installed Plugins. If a patch is not yet available at the time you discover this vulnerability, consider temporarily disabling the plugin until a fix is released, or implement compensating controls such as restricting admin access by IP address or requiring multi-factor authentication for administrator accounts.

Detection guidance

Enable request logging on your WordPress site to capture POST requests to the wp-admin/admin.php endpoint with the EmergencyWP settings handler. Look for requests lacking a valid nonce parameter or with nonce mismatches. Monitor admin change logs or database audit trails for unexpected modifications to plugin options (stored in wp_options table with keys related to EmergencyWP settings). Implement a Web Application Firewall (WAF) rule to flag or block settings modification requests that lack proper nonce tokens. Use WordPress security plugins such as Wordfence or Sucuri to track configuration changes and receive alerts.

Why prioritize this

Although the CVSS score is MEDIUM (4.3), this vulnerability should be prioritized for patching within your standard change management window because it directly affects plugin configuration integrity and requires no technical sophistication to exploit. The attack depends on social engineering rather than a zero-day or exploit kit, which lowers urgency compared to CRITICAL vulnerabilities, but the ease of exploitation and the sensitivity of the targeted settings (access control, email notification) warrant prompt attention. If your organization relies on EmergencyWP for critical workflows, prioritize patching accordingly.

Risk score, explained

The CVSS 3.1 score of 4.3 reflects a network-accessible vulnerability with low attack complexity and limited impact scope. The requirement for user interaction (an administrator must be socially engineered) and the absence of confidentiality or availability impact suppress the score. However, the integrity impact on sensitive configuration settings—particularly those governing role capabilities and email addresses—elevates concern beyond a purely numerical assessment. Organizations should evaluate their own reliance on EmergencyWP and the risk profile of their administrator base when deciding remediation urgency.

Frequently asked questions