CVE-2026-9732 is a CSRF vulnerability in the EmergencyWP – Dead Man's switch & legacy deliverance WordPress plugin affecting versions up to 1.4.2. The issue stems from missing or incorrect nonce validation in the form_settings_ui function responsible for handling settings saves. This allows unauthenticated attackers to perform unauthorized changes to critical plugin settings by inducing an administrator to execute a crafted request. The vulnerability impacts role capabilities, data erasure settings, timing configurations, and other plugin parameters.

An attacker can modify plugin settings without authentication by exploiting the CSRF vulnerability, potentially altering WordPress role capabilities (via add_cap/remove_cap), changing data-erasure-on-uninstall behavior, adjusting life-check timing values, and modifying email and page ID configurations. This could lead to unauthorized privilege changes and configuration manipulation, but does not directly disclose data or cause denial of service.

No official fix or patch is currently available for this vulnerability. Administrators should exercise caution and avoid clicking on untrusted links that could trigger settings changes. Monitor vendor advisories for updates and patches addressing this issue. Implementing additional CSRF protections or disabling the plugin until a fix is released may reduce risk.