CVE-2026-9732

{
  "id": "CVE-2026-9732",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-9732",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-06-03T13:53:36.560420Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@wordfence.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@wordfence.com",
      "affectedData": [
        {
          "vendor": "planetshaker",
          "product": "EmergencyWP – Dead Man's switch & legacy deliverance",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "semver",
              "lessThanOrEqual": "1.4.2"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-06-03T00:16:45.113",
  "references": [
    {
      "url": "https://plugins.trac.wordpress.org/browser/emergencywp/tags/1.4.2/pages/emergencywp/setting_tabs/settings_main.php#L17",
      "source": "security@wordfence.com"
    },
    {
      "url": "https://plugins.trac.wordpress.org/browser/emergencywp/tags/1.4.2/pages/emergencywp/setting_tabs/settings_main.php#L217",
      "source": "security@wordfence.com"
    },
    {
      "url": "https://plugins.trac.wordpress.org/browser/emergencywp/tags/1.4.2/pages/emergencywp/setting_tabs/settings_main.php#L79",
      "source": "security@wordfence.com"
    },
    {
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6013f592-4cff-4b94-968d-6f66e84368d0?source=cve",
      "source": "security@wordfence.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@wordfence.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The EmergencyWP – Dead Man's switch & legacy deliverance plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.2. This is due to missing or incorrect nonce validation on the form_settings_ui (settings save handler, procedural include scope) function. This makes it possible for unauthenticated attackers to modify plugin settings including the minimum access role (altering WordPress role capabilities via add_cap/remove_cap), the data-erasure-on-uninstall flag, life-check timing values, the mandator email address, the confirmation page ID, and date/time formats via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."
    },
    {
      "lang": "es",
      "value": "El plugin EmergencyWP - Dead Man's switch y entrega de legado para WordPress es vulnerable a falsificación de petición en sitios cruzados en todas las versiones hasta la 1.4.2, inclusive. Esto se debe a la validación de nonce faltante o incorrecta en la función form_settings_ui (gestor de guardado de ajustes, ámbito de inclusión procedural). Esto hace posible que atacantes no autenticados modifiquen los ajustes del plugin, incluyendo el rol de acceso mínimo (alterando las capacidades de rol de WordPress mediante add_cap/remove_cap), la bandera de borrado de datos al desinstalar, los valores de tiempo de verificación de vida, la dirección de correo electrónico del mandante, el ID de la página de confirmación y los formatos de fecha/hora, a través de una petición falsificada, siempre que puedan engañar a un administrador del sitio para que realice una acción como hacer clic en un enlace."
    }
  ],
  "lastModified": "2026-07-22T19:10:00.120",
  "sourceIdentifier": "security@wordfence.com"
}