What is the CVSS score of CVE-2026-8418?

CVE-2026-8418 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Games Catalog CVE-2026-8418

EUVD-2026-31014 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-05-20 Wordfence

GHSA-x342-qrpq-h2vr

WordPress CSRF

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 20, 2026 - 02:38 vuln.today

DescriptionCVE.org

The Games Catalog plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.0. This is due to missing or incorrect nonce validation on the gc_crud() function which handles the delete action (action=delete) via a GET request without any wp_verify_nonce() / check_admin_referer() call. This makes it possible for unauthenticated attackers to delete arbitrary game catalog entries (including the associated WordPress post created for the game) via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link.

AnalysisAI

Cross-Site Request Forgery in the Games Catalog WordPress plugin (versions ≤ 1.2.0) enables unauthenticated attackers to delete arbitrary game catalog entries and their associated WordPress posts by tricking a logged-in site administrator into clicking a crafted link. The vulnerable gc_crud() function in admin-crud.php processes the action=delete parameter via a GET request with no wp_verify_nonce() or check_admin_referer() call, bypassing WordPress's standard CSRF defenses entirely. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the attack surface is fully visible in the public WordPress plugin Trac repository, making it trivially constructible.

Technical ContextAI

CSRF (CWE-352) arises when a web application performs state-changing operations without confirming that requests originate from the authenticated user's own session intent. WordPress provides two standard CSRF guards - wp_verify_nonce() and check_admin_referer() - neither of which is invoked in the gc_crud() handler within admin-crud.php (lines 31 and 94, confirmed in the plugin Trac browser at plugins.trac.wordpress.org). Critically, the delete action is triggered via an HTTP GET request rather than a POST with a nonce-protected form, making it exploitable through passive mechanisms such as an img src attribute or an anchor tag that auto-loads in a browser. The affected CPE is cpe:2.3:a:askywhale:games_catalog:*:*:*:*:*:*:*:*, covering all versions of the askywhale Games Catalog plugin through and including the 1.2.0 tagged release also confirmed in Trac (game-catalog/tags/1.2.0/admin-crud.php). Because WordPress game entries create corresponding posts, successful exploitation destroys both the catalog record and its associated post object.

RemediationAI

No patched version is confirmed in the available intelligence - the fix version is not independently verified at time of analysis, and none of the references point to a changelog entry or release with a CSRF fix applied. Site administrators should monitor the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/0888cda8-63ca-44f6-a3eb-765c14a7e6c7 and the WordPress plugin repository for an updated release. As an immediate compensating control, deactivating the Games Catalog plugin eliminates the attack surface entirely; the trade-off is loss of plugin functionality. If deactivation is not feasible, restricting WordPress admin panel access to known IP ranges via server-level rules (nginx allow/deny or Apache RequireIP) reduces the window for social engineering by limiting who can hold an authenticated admin session. Enabling WordPress admin activity logging (via plugins such as WP Activity Log) provides detection capability for unauthorized delete operations. Do not rely on user education alone as a primary CSRF mitigation, as the GET-based trigger can be embedded invisibly in off-site content.