Cross-Site Request Forgery Vulnerability in MotorDesk Plugin for WordPress

CVE-2026-9724

What is CVE-2026-9724?

The MotorDesk plugin for WordPress is susceptible to Cross-Site Request Forgery due to improper nonce validation in the motordesk_admin_home function. This flaw allows unauthenticated attackers to manipulate the plugin's configuration settings, such as altering the search page URI and custom template directory path. To exploit this vulnerability, an attacker must deceive a site administrator into executing an action, such as clicking on a malicious link, thereby initiating a forged request that leverages the absence of proper security controls.

References