Executive brief
The EmergencyWP plugin for WordPress, which manages automated content release or account actions if a user becomes inactive, contains a security flaw that allows unauthorized changes to its settings. By tricking a site administrator into clicking a malicious link, an attacker can modify critical plugin configurations, such as changing user permissions or altering email notification settings. This could lead to unauthorized access or the disruption of the plugin's intended emergency functions.
Technical details
The EmergencyWP plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) due to missing or incorrect nonce validation on the 'form_settings_ui' function. This function serves as the settings save handler within a procedural include scope. An unauthenticated attacker can exploit this by inducing a site administrator to submit a forged request, typically via social engineering (e.g., clicking a link). Successful exploitation allows the attacker to modify plugin settings, including the minimum access role (via add_cap/remove_cap), data erasure flags, life-check timing, and the recipient email address. This vulnerability affects all versions up to and including 1.4.2.
Affected products
- EmergencyWP EmergencyWP – Dead Man's switch & legacy deliverance Up to, and including, 1.4.2
Timeline
- 2026-06-03: disclosed: Initial publication of the CVE record.
References
- https://plugins.trac.wordpress.org/browser/emergencywp/tags/1.4.2/pages/emergencywp/setting_tabs/settings_main.php
- https://plugins.trac.wordpress.org/browser/emergencywp/tags/1.4.2/pages/emergencywp/setting_tabs/settings_main.php
- https://plugins.trac.wordpress.org/browser/emergencywp/tags/1.4.2/pages/emergencywp/setting_tabs/settings_main.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/6013f592-4cff-4b94-968d-6f66e84368d0?source=cve