Cross-Site Request Forgery Vulnerability in cms-fuer-motorrad-werkstaetten Plugin by WordPress

CVE-2026-6451

What is CVE-2026-6451?

The cms-fuer-motorrad-werkstaetten plugin for WordPress contains a Cross-Site Request Forgery vulnerability that affects versions up to 1.0.0. This issue arises from a lack of nonce validation across eight AJAX deletion handlers, allowing unauthenticated attackers to impersonate logged-in users. Without proper nonce validation, malicious users could execute deletion requests for various entities, including vehicles, contacts, and suppliers, by tricking users into visiting a specially crafted link. The absence of capability checks further exacerbates this security flaw, making it critically important for users to update their plugins to prevent potential unauthorized data deletions.

References