PT-2026-45888 · WordPress · Emergencywp
CVSS v3.1
4.3
Medium
| Vector | AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
EmergencyWP – Dead Man's switch & legacy deliverance versions prior to 1.4.3
Description
The plugin is susceptible to Cross-Site Request Forgery due to missing or incorrect nonce validation in the
form settings ui() function. This allows unauthenticated attackers to modify plugin settings by tricking a site administrator into clicking a malicious link. Affected settings include the minimum access role, the data-erasure-on-uninstall flag, life-check timing values, the mandatory email address, the confirmation page ID, and date/time formats. Nonce validation is a security mechanism used to ensure that a request was intentionally sent by the user and not forged by a third party.Recommendations
Update to a version later than 1.4.2.
As a temporary workaround, restrict access to the
form settings ui() function to minimize the risk of exploitation.Fix
CSRF
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Emergencywp