CVE-2022-26366

The AdRotate Banner Manager plugin before version 5.9.1 contains a cross-site request forgery vulnerability stemming from inadequate nonce verification in the adrotate_options() function. An unauthenticated attacker could exploit this flaw by crafting a malicious request and convincing a site administrator to click a link, allowing the attacker to execute unauthorized actions on the affected WordPress installation.

Based on public CVE data (MITRE/NVD).