The CMS für Motorrad Werkstätten plugin contains eight AJAX deletion handlers that lack any nonce verification or permission checks. As a result, an unauthenticated attacker can force any logged‑in user to delete vehicles, contacts, suppliers, receipts, positions, catalog articles, stock items, or entire supplier catalogs by sending a crafted request. This flaw can compromise integrity and availability of the data managed by the plugin, and it represents a classic Cross‑Site Request Forgery vulnerability classified as CWE‑352.

WordPress installations using the CMS für Motorrad Werkstätten plugin version 1.0.0 or earlier are affected. The plugin is distributed by tholstkabelbwde under the product name "CMS für Motorrad Werkstätten" and the vulnerability applies to all instances of the 1.0.0 release and any lower revisions.

The vulnerability carries a CVSS score of 4.3, indicating moderate severity. No EPSS figure is available, and the flaw is not currently listed in the CISA KEV catalog. Likely attack requires an attacker to deliver a forged request to a logged‑in user—typically by hosting a malicious page that contains the AJAX endpoint URL—so that the user unknowingly submits a delete operation. Because no authentication is required for the attacker, and the plugin does not protect the handlers, the exploit path is straightforward and the risk to sites running the affected plugin is moderate.