CVE-2026-4070

Vulnerability

The Alfie – Feed Plugin for WordPress versions up to and including 1.2.1 is vulnerable to Cross-Site Request Forgery (CSRF). The alfie_manage() function in alfie-manage.php handles feed deletion via the 'delete' GET parameter without proper nonce validation [1][2]. An attacker can exploit this to delete arbitrary feed data from the alfie_colindex, alfie_producten, alfie_reactions, and alfie_searchproduct database tables.

Exploitation

An unauthenticated attacker can craft a malicious link or form that triggers the alfie_manage() function with a 'delete' parameter. The attacker must trick a site administrator into clicking the link or submitting the form while authenticated to WordPress. No further authentication or privileges are required for the attacker beyond social engineering.

Impact

Successful exploitation allows an attacker to delete arbitrary plugin feed data stored in the specified database tables. This can lead to loss of product feed information, disruption of functionality, and potential data integrity issues. The impact is limited to the plugin's data and does not directly affect the core WordPress installation.

Mitigation

The vendor has not released a fixed version as of the publication date. The vulnerability is present in all versions up to 1.2.1. Users should consider disabling the plugin or implementing additional CSRF protection, such as a Web Application Firewall (WAF) rule to block requests lacking a nonce. Alternatively, users can contact the vendor for a patch.