CVE-2026-9734 describes a CSRF vulnerability in the W3SC Elementor to Zoho CRM plugin for WordPress. The issue is due to missing or incorrect nonce validation on the storeInfo function, enabling unauthenticated attackers to modify critical plugin settings by inducing an authenticated administrator to execute a forged request. This affects all plugin versions up to and including 2.2.0. The vulnerability allows attackers to replace Zoho CRM integration credentials, potentially disrupting CRM operations or enabling further attacks.

The vulnerability allows an unauthenticated attacker to modify the plugin's Zoho CRM integration settings by tricking an administrator into performing an action. This can lead to the replacement of sensitive configuration data such as data center, client ID, client secret, and user email credentials with attacker-controlled values. While it does not directly disclose data or cause denial of service, it compromises the integrity of CRM integration settings, which may impact business processes relying on Zoho CRM.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should be cautious about clicking on untrusted links while logged into WordPress with administrative privileges. Monitoring for plugin updates from w3scloud is recommended to apply any official fixes once released.