WP DB Booster, a WordPress plugin, is vulnerable to Cross‑Site Request Forgery due to missing nonce validation on the cleanup_all AJAX action. The flaw allows an unauthenticated attacker to forge a request that, if an administrator is tricked into clicking a malicious link, results in the permanent deletion of database records such as post drafts, revisions, comments and metadata.

The vulnerability affects the WP Maniax WP DB Booster plugin versions up to and including 1.0.1; any WordPress site installing these versions is exposed if an administrator’s dashboard is accessed.

The CVSS score of 4.3 reflects moderate severity, and the EPSS score below 1% indicates a very low exploitation probability. Because the exploit requires the victim to act as an administrator, the attack is not fully remote and is listed as not in CISA KEV. Nonetheless, any site that can be tricked into executing the action is at risk of data loss; the absence of a nonce means the action can be called from any origin with no authentication, making the flaw readily exploitable with a simple forged link.