PT-2026-43495 · WordPress · Cm Ad Changer

Jamaal · CVE-2026-9236 · Published 2026-05-27 · Updated 2026-05-27

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions CM Ad Changer versions prior to 2.0.8

Description The CM Ad Changer plugin for WordPress is susceptible to Cross-Site Request Forgery (CSRF), a flaw where an attacker tricks a victim into executing unwanted actions. This occurs due to missing or incorrect nonce validation within the cmac campaigns action() function. Unauthenticated attackers can exploit this to permanently delete arbitrary advertising campaigns, including associated banner records and uploaded files, by inducing a site administrator to click a malicious link.

Recommendations Update the plugin to version 2.0.8 or later. As a temporary workaround, restrict administrative access to the plugin settings to minimize the risk of exploitation.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2026-9236

Affected Products

Cm Ad Changer

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-9236 · Security Note
• https://plugins.trac.wordpress.org/browser/cm-ad-changer/tags/2.0.7/backend/cm-ad-changer-backend.php#L167 · Note
• https://plugins.trac.wordpress.org/browser/cm-ad-changer/tags/2.0.7/backend/cm-ad-changer-backend.php#L177 · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3544026%40cm-ad-changer&new=3544026%40cm-ad-changer&sfp_email=&sfph_mail= · Note
• https://t.me/cveNotify/164799 · Telegram Post
• https://plugins.trac.wordpress.org/browser/cm-ad-changer/tags/2.0.7/shared/classes/cmac-data.php#L363 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/a335c917-3fff-4079-bb38-64cd665c5c38?source=cve · Note