CVE-2026-9732 is a CSRF vulnerability in the EmergencyWP – Dead Man's switch & legacy deliverance WordPress plugin affecting all versions up to 1.4.2. The issue arises from missing or incorrect nonce validation in the form_settings_ui function responsible for handling settings saves. Exploitation requires tricking an authenticated site administrator into performing an action such as clicking a malicious link, which then allows modification of plugin settings including WordPress role capabilities, data-erasure-on-uninstall flags, life-check timing, mandator email, confirmation page ID, and date/time formats. The vulnerability does not allow direct code execution or data disclosure but can lead to unauthorized configuration changes.

An attacker can leverage this CSRF vulnerability to modify critical plugin settings by inducing an administrator to perform a forged request. This includes changing minimum access roles, which can alter WordPress role capabilities, potentially weakening site security. Other impacted settings include data-erasure-on-uninstall flags and timing parameters, which could affect plugin behavior and data handling. There is no direct confidentiality or availability impact reported. No known active exploitation has been observed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should exercise caution with links and requests received while logged into WordPress, especially those related to plugin settings. Implementing additional CSRF protections or restricting administrative access may reduce risk. Monitor official vendor channels for updates and patches.