CVE-2026-9724
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk4th percentile — higher than 4% of all known CVEs
Summary
The MotorDesk plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 1.1.2. This is due to missing or incorrect nonce validation on the motordesk_admin_home function.
Risk Assessment
Unauthenticated attackers can update the plugin's configuration settings, which may lead to unauthorized changes in the site's operation.
Recommendation
It is recommended to update the plugin to the latest version to mitigate this vulnerability and implement additional security measures against CSRF attacks.
Original NVD description (English source)
The MotorDesk plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.2. This is due to missing or incorrect nonce validation on the motordesk_admin_home function. This makes it possible for unauthenticated attackers to update the plugin's configuration settings, including the search page URI and custom template directory path via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.