The Alfie – Feed Plugin for WordPress contains a CSRF vulnerability in all releases up to and including version 1.2.1. The core issue is missing nonce validation within the alfie_manage() function when handling the 'delete' GET parameter. This omission allows an attacker to craft a request that, if authorized users are tricked into visiting it, will invoke the feed deletion routine and permanently remove data from several plugin tables (alfie_colindex, alfie_producten, alfie_reactions, and alfie_searchproduct). Because the vulnerability directly bypasses any form of authentication verification, the impact is the loss of data integrity for the plugin’s feeds.

WordPress sites running the Alfie – Feed Plugin version 1.2.1 or earlier. Any installation of the plugin from the pftool:Alfie vendor package is therefore susceptible. The specific tables affected store the plugin’s feed definitions, product entries, reaction logs, and search product entries.

The CVSS score of 4.3 categorizes this as a moderate severity issue. No EPSS value is available, and the vulnerability is not listed in CISA’s KEV catalog, which suggests the probability of widespread exploitation remains unquantified. The attack vector is inferred to be CSRF via a forged GET request that an attacker can embed in a link or form, relying on an administrative user visiting the link while authenticated. Once triggered, the attacker can delete arbitrary feed data without needing any privileged credentials, but only while the victim’s session remains active.