CVE-2026-8902 is a CSRF vulnerability in the AJAX Report Comments WordPress plugin (versions up to 2.0.4). The issue arises from missing or incorrect nonce validation on the rc_options_page function, which manages plugin settings. An attacker can exploit this by crafting a forged request that, when executed by an authenticated administrator (e.g., via clicking a link), modifies plugin configuration parameters without authorization. The vulnerability does not impact confidentiality or availability but allows integrity modification of plugin settings. No known exploits are reported in the wild, and no patch or official remediation level has been provided by the vendor.

An attacker can cause unauthorized changes to plugin settings by exploiting the CSRF vulnerability, potentially altering how the plugin behaves or how notifications are sent. This does not lead to data disclosure or service disruption but can affect the integrity of plugin configuration. The medium CVSS score reflects the limited scope of impact and the requirement for user interaction by an administrator.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid clicking untrusted links while logged into WordPress with administrative privileges and consider disabling or removing the AJAX Report Comments plugin if feasible. Implementing additional CSRF protections at the WordPress or server level may help mitigate risk.