Junglewise Threat Intelligence

CVE-2026-9732: EmergencyWP WordPress Plugin CSRF in form_settings_ui

CVE-2026-9732 · Severity: medium · CVSS 4.3 · Published 2026-06-03

Executive brief

The EmergencyWP plugin for WordPress, which manages automated content release or account actions if a user becomes inactive, contains a security flaw that allows unauthorized changes to its settings. By tricking a site administrator into clicking a malicious link, an attacker can modify critical plugin configurations, such as changing user permissions or altering email notification settings. This could lead to unauthorized access or the disruption of the plugin's intended emergency functions.

Technical details

The EmergencyWP plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) due to missing or incorrect nonce validation on the 'form_settings_ui' function. This function serves as the settings save handler within a procedural include scope. An unauthenticated attacker can exploit this by inducing a site administrator to submit a forged request, typically via social engineering (e.g., clicking a link). Successful exploitation allows the attacker to modify plugin settings, including the minimum access role (via add_cap/remove_cap), data erasure flags, life-check timing, and the recipient email address. This vulnerability affects all versions up to and including 1.4.2.

Affected products

  • EmergencyWP EmergencyWP – Dead Man's switch & legacy deliverance Up to, and including, 1.4.2

Timeline

  • 2026-06-03: disclosed: Initial publication of the CVE record.

References