CVE-2026-8902 is a CSRF vulnerability in the AJAX Report Comments WordPress plugin (versions up to 2.0.4). The issue arises from missing or incorrect nonce validation in the rc_options_page function, enabling attackers to forge requests that modify plugin configuration settings without authentication. Exploitation requires tricking a site administrator into clicking a crafted link or performing an action that triggers the malicious request. The vulnerability impacts integrity by allowing unauthorized changes to plugin behavior and notification parameters. No official fix or patch has been documented as of the published date.

An attacker can cause an authenticated administrator to unknowingly change plugin settings, potentially altering how reports are handled, displayed, or notified. This could lead to misleading messages, altered thresholds for comment reporting, or changes in notification recipients and content. While there is no direct confidentiality or availability impact, the integrity of plugin configuration is compromised, which may affect site moderation and user experience.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should exercise caution when clicking links or performing actions from untrusted sources. Implementing additional CSRF protections or nonce validation manually may mitigate the risk. Monitoring official vendor channels for updates is recommended.