CVE-2026-9599 describes a CSRF vulnerability in the russellr Tectite Forms WordPress plugin affecting all versions up to 1.3. The root cause is missing or incorrect nonce validation on the admin_init function, which is intended to protect against unauthorized state-changing requests. Exploitation requires tricking a site administrator into executing a forged request, enabling modification of plugin settings including the tectite_forms_button option. No official patch or remediation level has been published as of the data provided.

An attacker can modify plugin settings without authentication by exploiting the CSRF vulnerability, potentially altering the behavior or appearance of forms managed by the plugin. There is no direct confidentiality or availability impact reported, but integrity of plugin configuration is compromised. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should avoid clicking untrusted links while logged into WordPress with sufficient privileges. Monitoring for updates from the plugin vendor or WordPress security advisories is recommended.