CVE-2026-9723 is a Cross-Site Request Forgery vulnerability in the Google Plus One Bottom WordPress plugin (versions up to 0.0.2). The issue arises from missing or incorrect nonce validation in the googlePlusOneAdmin function, which manages plugin settings. An attacker can exploit this by tricking an authenticated site administrator into executing a forged request, enabling unauthorized modification of plugin options such as plusone-lang, plusone-callback, and plusone-url. The vulnerability does not require privileges or direct user interaction beyond the administrator clicking a crafted link. The CVSS score of 4.3 reflects the limited impact on integrity without confidentiality or availability impact. There is no vendor-provided patch or official remediation at this time.

An attacker can modify certain plugin settings without authentication by exploiting the CSRF vulnerability, potentially altering the behavior of the Google Plus One Bottom plugin. This could lead to integrity issues in the plugin's configuration but does not affect confidentiality or availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should avoid clicking on suspicious links and consider disabling or removing the affected plugin if feasible. Implementing general CSRF protections at the WordPress or web server level may reduce risk but are not specific fixes for this vulnerability.