CVE-2026-9236: CM Ad Changer <= 2.0.7 - Cross-Site Request Forgery to Campaign Deletion via Campaign Management
Vulnerability summary
CVE-2026-9236 is a medium (CVSS 4.3) Cross-Site Request Forgery (CSRF) vulnerability in creativemindssolutions cm ad changer – a simple tool to control and optimize your site's banners. EPSS estimates a 0.19% chance of exploitation in the next 30 days, higher than 8.2% of scored vulnerabilities.
Timeline
- 27-05-2026PublishedVulnerability first disclosed.
- 27-05-2026Last modifiedVulnerability information updated.
Description
The CM Ad Changer – A simple tool to control and optimize your site's banners plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.7. This is due to missing or incorrect nonce validation on the cmac_campaigns_action function. This makes it possible for unauthenticated attackers to permanently delete arbitrary advertising campaigns, including their associated banner records and uploaded files via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS metrics
3 scores · 3 sources · 1 version- NVDNIST4.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
- wordfenceSource4.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
EPSS trend
Probability
0.19%
Chance of exploitation in the next 30 days
Percentile
8%
Versus all other CVEs
30-day change
Increase +0.06 pp
From 0.13% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Creativemindssolutions1 product
Wordpress1 product
- cm-ad-changer≤ 2.0.7 (fixed in 2.0.8)
2 vendors · 2 products