Atomic Edge analysis of CVE-2026-9732 (metadata-based): The EmergencyWP – Dead Man’s switch & legacy deliverance plugin for WordPress (versions up to and including 1.4.2) contains a Cross-Site Request Forgery (CSRF) vulnerability in the form_settings_ui function. This flaw allows unauthenticated attackers to modify plugin settings, including security-critical options, by tricking a site administrator into performing an unintended action. The CVSS score is 4.3 (Medium), reflecting the need for user interaction but the potential for unauthorized settings changes.
The root cause is a missing or incorrect nonce validation on the form_settings_ui settings save handler. In WordPress, plugin settings forms should include a nonce (via wp_nonce_field()) and validate it with check_admin_referer() or wp_verify_nonce() before processing updates. Atomic Edge analysis concludes that this plugin either called the settings handler directly without a nonce check or used a nonce field that was never verified. This conclusion is inferred from the CWE-352 classification and the vulnerability description explicitly stating “missing or incorrect nonce validation.” Without a code diff, the exact omission is unconfirmed, but the pattern matches common WordPress CSRF vulnerabilities.
Exploitation requires an attacker to craft a malicious HTML form or link that targets the plugin’s settings update endpoint. The affected handler is likely tied to an AJAX action or POST handler registered via WordPress hooks. Based on the plugin slug “emergencywp,” the endpoint is likely /wp-admin/admin-ajax.php with an action parameter like emergencywp_save_settings or similar. The attacker must lure an authenticated administrator with manage_options or equivalent permissions into clicking a link or submitting a form. The forged request modifies parameters such as minimum_access_role (which alters role capabilities via add_cap/remove_cap), erasure_on_uninstall flag, life_check_interval, mandator_email, confirmation_page_id, and date_time_format. A realistic payload would use a CSRF form with hidden inputs for each setting.
Remediation requires adding proper nonce validation to the form_settings_ui function. The developer must generate a nonce in the settings form using wp_nonce_field(’emergencywp_settings_nonce’) and verify it before saving with if ( ! isset( $_POST[‘_wpnonce’] ) || ! wp_verify_nonce( $_POST[‘_wpnonce’], ’emergencywp_settings_nonce’ ) ) { return; }. Additional best practices include capability checks (current_user_can(‘manage_options’)) and input sanitization/validation for each saved setting. Since no patched version exists, sites should uninstall the plugin or implement the virtual patch.
The impact of successful CSRF exploitation is unauthorized modification of plugin settings, which can reduce site security. An attacker could change the minimum access role to a lower permission level such as “subscriber,” granting privilege escalation to that role (e.g., by using add_cap to give subscribers admin-level capabilities via the plugin’s role-casting feature). Disabling the data-erasure-on-uninstall flag prevents cleanup of sensitive data when the plugin is removed. Altering life-check timing values could disrupt the dead man’s switch functionality. Changing the mandator email address redirects notifications to the attacker. The confirmation page ID could redirect users to malicious sites. While the impact is primarily integrity-based (score 4.3), privilege escalation via role manipulation can have cascading security implications.
