What is the CVSS score of CVE-2026-9732?

CVE-2026-9732 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

EmergencyWP CVE-2026-9732

EUVD-2026-34055 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-06-03 security@wordfence.com

GHSA-q5fr-rj8r-242w

WordPress CSRF

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 03, 2026 - 00:28 vuln.today

CVE Published

Jun 03, 2026 - 00:16 nvd

MEDIUM 4.3

DescriptionCVE.org

The EmergencyWP - Dead Man's switch & legacy deliverance plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.2. This is due to missing or incorrect nonce validation on the form_settings_ui (settings save handler, procedural include scope) function. This makes it possible for unauthenticated attackers to modify plugin settings including the minimum access role (altering WordPress role capabilities via add_cap/remove_cap), the data-erasure-on-uninstall flag, life-check timing values, the mandator email address, the confirmation page ID, and date/time formats via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

AnalysisAI

Cross-Site Request Forgery in the EmergencyWP WordPress plugin (all versions ≤1.4.2) permits unauthenticated attackers to overwrite critical plugin settings by tricking an authenticated site administrator into triggering a forged request. The missing nonce validation in the form_settings_ui settings save handler exposes controls that include WordPress role capability manipulation (add_cap/remove_cap), a data-erasure-on-uninstall flag, life-check timing, and the mandator notification email - settings whose combined impact exceeds the CVSS 4.3 baseline. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, though the role-capability attack surface warrants prioritized patching for sites relying on this plugin.

Technical ContextAI

This is a CWE-352 (Cross-Site Request Forgery) vulnerability rooted in absent or incorrect WordPress nonce validation. WordPress plugins are expected to call check_admin_referer() or wp_verify_nonce() before processing any state-changing form submission; the EmergencyWP plugin's form_settings_ui function - a procedural include-scope settings save handler - omits this check at multiple points. The vulnerable code is publicly browsable in the WordPress plugin Trac repository at pages/emergencywp/setting_tabs/settings_main.php, specifically at lines 17, 79, and 217, suggesting the nonce gate is bypassed across distinct processing branches (initial load, save dispatch, and a secondary handler). The plugin's 'Dead Man's Switch' design makes its settings uniquely sensitive: it invokes WordPress's add_cap/remove_cap API to alter role capabilities, can trigger destructive data erasure on uninstall, and controls timed notification delivery - all modifiable via the unprotected handler. No CPE string was provided in the source data.

RemediationAI

No specific patched version number was referenced in the available data - the exact fix version must be verified against the WordPress plugin repository (https://wordpress.org/plugins/emergencywp/) or the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/6013f592-4cff-4b94-968d-6f66e84368d0 before upgrading. Site administrators should update to the latest available release beyond 1.4.2 once a patched version is confirmed. As a compensating control while awaiting a patch, administrators should deactivate the EmergencyWP plugin - note this disables the dead man's switch and legacy delivery functionality, which may have operational consequences for sites depending on those features. Restricting WordPress admin panel access to known IP ranges via web server configuration (e.g., Nginx location block or Apache .htaccess) reduces the attack surface by limiting where authenticated admin sessions can originate, making the social-engineering prerequisite harder to satisfy. Avoiding clicking links in unsolicited communications while logged into WordPress admin is the minimal procedural control.