CVE-2026-9724: MotorDesk WordPress Plugin CSRF Vulnerability

CVE-2026-9724 Overview

CVE-2026-9724 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the MotorDesk plugin for WordPress in all versions up to and including 1.1.2. The flaw exists in the motordesk_admin_home function, which lacks proper nonce validation. Unauthenticated attackers can craft malicious requests that, when triggered by an authenticated administrator clicking a link, modify the plugin's configuration. Affected settings include the search page URI and the custom template directory path. The weakness is classified under CWE-352: Cross-Site Request Forgery.

Critical Impact
Attackers can alter MotorDesk plugin configuration values on a vulnerable WordPress site by tricking an administrator into clicking a crafted link, enabling unauthorized changes to search page URI and template directory paths.

Affected Products

MotorDesk plugin for WordPress, versions up to and including 1.1.2
WordPress sites with the MotorDesk plugin installed and active
Administrator accounts authenticated to vulnerable WordPress instances

Discovery Timeline

2026-06-24 - CVE CVE-2026-9724 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-9724

Vulnerability Analysis

The MotorDesk plugin exposes an administrative handler, motordesk_admin_home, that processes configuration updates submitted by site administrators. The handler accepts state-changing requests without verifying a WordPress nonce token, breaking the anti-CSRF control WordPress provides for admin actions. An unauthenticated remote attacker cannot directly invoke the function, but they can host a page that submits a forged request to the target site. When an authenticated administrator visits the attacker-controlled page, the browser sends the request using the administrator's session cookies. The plugin then accepts the request as legitimate and applies the supplied configuration values. Network access combined with user interaction is required to complete the attack.

Root Cause

The root cause is missing or incorrect nonce validation on the motordesk_admin_home function. WordPress provides wp_verify_nonce() and check_admin_referer() helpers to bind state-changing requests to a session-specific token, but the plugin does not invoke these checks before persisting the submitted settings. Code paths referenced in the WordPress plugin repository at lines 122, 134, 157, and 182 of include/motordesk_admin.php handle configuration writes without a token check. See the WordPress MotorDesk Code Review for the affected source.

Attack Vector

The attacker prepares a web page containing an auto-submitting HTML form or fetch call that targets the MotorDesk admin endpoint with attacker-controlled values for the search page URI and the custom template directory path. The attacker then delivers the page link to a site administrator through phishing, social media, or a comment field. Once the administrator clicks the link while authenticated to the WordPress dashboard, the browser submits the request with valid session cookies, and the plugin writes the malicious settings. See the Wordfence Vulnerability Analysis for additional context.

Detection Methods for CVE-2026-9724

Indicators of Compromise

Unexpected changes to the MotorDesk search page URI value in WordPress options.
Modifications to the custom template directory path pointing to unfamiliar locations.
WordPress access logs showing POST requests to MotorDesk admin endpoints originating from external Referer headers.
Administrator sessions submitting configuration changes shortly after clicking external links.

Detection Strategies

Audit the WordPress wp_options table for unauthorized changes to MotorDesk-related keys.
Compare current plugin configuration against a known-good baseline on a recurring schedule.
Inspect web server access logs for POST requests to the plugin admin handler with cross-origin Referer values.
Enable WordPress activity logging plugins to track settings changes by user and timestamp.

Monitoring Recommendations

Alert on file system writes to template directories not under the standard WordPress themes path.
Monitor outbound requests from the WordPress server that could result from a redirected search page URI.
Track administrator login sessions for navigation patterns that include external referrers immediately preceding settings changes.

How to Mitigate CVE-2026-9724

Immediate Actions Required

Update the MotorDesk plugin to a version newer than 1.1.2 when the vendor releases a patched release.
Review and restore MotorDesk configuration values, specifically the search page URI and custom template directory path, to known-good settings.
Require administrators to log out of the WordPress dashboard before browsing untrusted links.
Restrict administrator account usage to dedicated browser profiles or sessions.

Patch Information

At the time of NVD publication, no fixed version had been documented in the available references. Site operators should monitor the Wordfence Vulnerability Analysis and the WordPress plugin repository for an updated release that adds nonce validation to the motordesk_admin_home function.

Workarounds

Deactivate the MotorDesk plugin until a patched version is available if the configuration risk is unacceptable.
Deploy a web application firewall rule that blocks POST requests to MotorDesk admin endpoints lacking a valid same-origin Referer header.
Enforce SameSite cookie attributes on WordPress authentication cookies to reduce cross-site request submission.
Limit administrator account privileges and use role separation so routine browsing is performed under lower-privileged accounts.

bash

# Example WAF rule concept: block cross-origin POSTs to MotorDesk admin endpoints
# (adapt to your WAF syntax)
SecRule REQUEST_METHOD "@streq POST" \
  "chain,deny,status:403,id:1029724,msg:'Block cross-origin POST to MotorDesk admin'"
  SecRule REQUEST_URI "@contains motordesk_admin" "chain"
  SecRule REQUEST_HEADERS:Referer "!@beginsWith https://your-site.example/"