CVE-2026-9236 describes a CSRF vulnerability in the CM Ad Changer WordPress plugin, affecting all versions up to and including 2.0.7. The root cause is missing or incorrect nonce validation on the cmac_campaigns_action function, which handles campaign-related actions. This flaw enables attackers to craft forged requests that, when executed by an authenticated site administrator, result in the permanent deletion of advertising campaigns and associated data. The vulnerability does not require privileges or direct authentication but relies on social engineering to induce an administrator to trigger the malicious request.

An attacker can cause the permanent deletion of advertising campaigns, banner records, and uploaded files by exploiting this CSRF vulnerability. This results in loss of advertising content and potential disruption of site banner management. There is no direct confidentiality or availability impact beyond the deletion of campaign data. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, site administrators should exercise caution when clicking on links or performing actions from untrusted sources. Implementing additional CSRF protections such as nonce validation or using security plugins that enforce request validation may help mitigate risk.