What is the CVSS score of CVE-2026-4070?

CVE-2026-4070 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Alfie Feed Plugin CVE-2026-4070

EUVD-2026-31411 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-05-22 Wordfence

GHSA-v8xg-3gv8-m4wc

WordPress CSRF

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 22, 2026 - 05:16 vuln.today

DescriptionCVE.org

The Alfie - Feed Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.1. This is due to missing nonce validation on the alfie_manage() function which handles feed deletion via the 'delete' GET parameter. This makes it possible for unauthenticated attackers to delete arbitrary plugin feed data (from alfie_colindex, alfie_producten, alfie_reactions, and alfie_searchproduct tables) via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

AnalysisAI

Cross-Site Request Forgery in the Alfie - Feed Plugin for WordPress (all versions ≤ 1.2.1) allows unauthenticated remote attackers to delete arbitrary plugin feed data by tricking a logged-in site administrator into clicking a crafted link. The missing nonce validation on the alfie_manage() function means any forged GET request containing the 'delete' parameter will be processed without verifying its origin, permanently removing records from the plugin's four database tables. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the low attack complexity and purely social-engineering prerequisite make it a credible threat against active WordPress sites using this plugin.

Technical ContextAI

The vulnerability is classified under CWE-352 (Cross-Site Request Forgery), a root cause where a server-side action is triggered by a forged client request because the application does not verify that the request originated from a legitimate, authenticated session. In WordPress, the standard defense is nonce validation - a time-limited token embedded in forms and verified server-side - which is absent here in the alfie_manage() function (confirmed at include/alfie-manage.php lines 58 and 60 in both the 1.2.1 release tag and the current trunk). The affected function handles feed lifecycle management including deletion via a plain GET parameter ('delete'), meaning the destructive action can be triggered by a link rather than a form submission. The CPE cpe:2.3:a:pftool:alfie_-_feed_plugin:*:*:*:*:*:*:*:* identifies the vendor as pftool and confirms the entire released version range is affected. The four impacted tables (alfie_colindex, alfie_producten, alfie_reactions, alfie_searchproduct) represent the plugin's core feed configuration and product data, making their deletion disruptive to any site relying on the plugin for product feed generation.

RemediationAI

No vendor-released patched version has been identified at the time of analysis - review of the WordPress plugin Trac confirms the vulnerable code remains present in trunk (alfie-manage.php lines 58 and 60). Site administrators should monitor the WordPress plugin repository and the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/af36719a-8f7d-46dc-a697-cfcbb08e45e2 for a patched release and upgrade immediately once one is available. As an interim compensating control, administrators who do not actively require feed management functionality should deactivate or remove the plugin entirely, which eliminates the attack surface at the cost of disabling all plugin features. If the plugin must remain active, administrators should exercise heightened vigilance against unsolicited links in emails, comments, or messages while logged into the WordPress admin dashboard - the attack depends entirely on an authenticated admin clicking a forged URL. Implementing a Web Application Firewall rule to block GET requests to the alfie_manage endpoint containing the 'delete' parameter from unauthenticated or external referrers may provide additional defense-in-depth, though WAF bypass is possible in some configurations.