CVE-2026-9722 describes a CSRF vulnerability in the Laiser Tag plugin for WordPress affecting all versions up to 1.2.5. The root cause is missing or incorrect nonce validation in the addOptionsPageFields function. This flaw enables unauthenticated attackers to update plugin settings by tricking an authenticated administrator into submitting a forged request. The vulnerability impacts the integrity of plugin configuration but does not affect confidentiality or availability. No official patch or remediation level has been provided yet, and no known exploits are reported in the wild.

An attacker can cause an authenticated site administrator to unknowingly change critical plugin settings, including the API key and tagging parameters. This could lead to unauthorized configuration changes that may affect the plugin's behavior and potentially the site's operation. There is no direct impact on confidentiality or availability reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should be cautious about clicking on untrusted links while logged into WordPress with administrative privileges. Implementing manual nonce validation or other CSRF protections in the plugin code may mitigate the risk.