CVE-2026-9724

Name of the Vulnerable Software and Affected Versions MotorDesk versions prior to 1.1.3

Description The MotorDesk plugin for WordPress contains a Cross-Site Request Forgery (CSRF) flaw, which occurs when a web application allows an attacker to induce a user to perform actions they do not intend to. This issue is caused by missing or incorrect nonce validation in the motordesk admin home() function. Unauthenticated attackers can exploit this by tricking a site administrator into clicking a link, allowing the attacker to update plugin configuration settings, specifically the search page URI and the custom template directory path.

Recommendations Update to a version later than 1.1.2. As a temporary workaround, restrict access to the motordesk admin home() function to minimize the risk of exploitation.