EUVD-2026-23390
GHSA-8mf7-m4px-v9qq
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
The cms-fuer-motorrad-werkstaetten plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to and including 1.0.0. This is due to missing nonce validation on all eight AJAX deletion handlers: vehicles_cfmw_d_vehicle, contacts_cfmw_d_contact, suppliers_cfmw_d_supplier, receipts_cfmw_d_receipt, positions_cfmw_d_position, catalogs_cfmw_d_article, stock_cfmw_d_item, and settings_cfmw_d_catalog. None of these handlers call check_ajax_referer() or wp_verify_nonce(), nor do they perform any capability checks via current_user_can(). This makes it possible for unauthenticated attackers to delete arbitrary vehicles, contacts, suppliers, receipts, positions, catalog articles, stock items, or entire supplier catalogs via a forged request, provided they can trick a logged-in user into performing an action such as clicking a link to a malicious page.
AnalysisAI
Cross-Site Request Forgery (CSRF) in the cms-fuer-motorrad-werkstaetten WordPress plugin version 1.0.0 and earlier allows unauthenticated attackers to delete arbitrary vehicles, contacts, suppliers, receipts, positions, catalog articles, stock items, and supplier catalogs by tricking logged-in users into clicking a malicious link. Eight AJAX handlers lack nonce validation and capability checks, enabling direct data destruction without authentication or authorization verification. User interaction is required (UI:R), limiting the attack to social engineering scenarios rather than direct network exploitation.
Technical ContextAI
The vulnerability exists in the WordPress plugin architecture where AJAX handlers (add_action with 'wp_ajax_*' hooks) are not properly secured. WordPress provides two primary defense mechanisms: wp_verify_nonce() for CSRF token validation and current_user_can() for role-based capability checks. The affected plugin registers eight AJAX deletion handlers across multiple modules (vehicles, contacts, suppliers, receipts, positions, catalogs, stock items) that execute database deletion operations without either mechanism. When a logged-in WordPress user (identified by session cookie) visits an attacker-controlled page containing a crafted form or JavaScript that triggers one of these AJAX endpoints, the user's browser automatically includes their authenticated session cookies, allowing the malicious request to execute with that user's privileges. This is a classic CSRF attack leveraging the stateless nature of AJAX requests combined with WordPress's cookie-based session management.
RemediationAI
Update the cms-fuer-motorrad-werkstaetten plugin to a patched version if released by the developer; check the WordPress plugin repository or contact the developer at tholstkabelbwde for availability. As an immediate mitigation, disable the plugin entirely until a security update is available (action: deactivate and remove plugin, side effect: motorcycle workshop management features become unavailable). If continued operation is required, implement Web Application Firewall (WAF) rules blocking requests to the vulnerable AJAX endpoints (vehicles_cfmw_d_vehicle, contacts_cfmw_d_contact, suppliers_cfmw_d_supplier, receipts_cfmw_d_receipt, positions_cfmw_d_position, catalogs_cfmw_d_article, stock_cfmw_d_item, settings_cfmw_d_catalog) from external sources, though this requires identifying legitimate internal traffic patterns and may block legitimate administrators. Restrict WordPress admin access to trusted IP address ranges only, reducing the attack surface by limiting which systems can host vulnerable sessions. Educate administrators never to click external links while logged into WordPress, though this is a weak compensating control relying on human behavior.
The Waiting: One-click Countdowns WordPress Plugin, version <= 0.6.2, is affected by an authenticated SQL injection vuln
The YourChannel WordPress plugin before 1.2.2 does not sanitize and escape some parameters, which could allow users with
The Waiting: One-click countdowns plugin for WordPress is vulnerable to authorization bypass due to a missing capability
The YourChannel plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check when r
The YourChannel plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check when c
SQL injection in the CMS für Motorrad Werkstätten WordPress plugin (versions up to 1.0.0) allows authenticated attackers
The Waiting: One-click countdowns plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, an
The Waiting: One-click countdowns plugin for WordPress is vulnerable to authorization bypass due to missing capability c
The YourChannel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to,
The Waiting: One-click countdowns plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Countdown na
The YourChannel plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.4
The YourChannel plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.4
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today