The Games Catalog plugin contains a CSRF vulnerability where the delete action is triggered via a GET request without nonce validation. An attacker can craft a malicious URL and trick an administrator into invoking the link, leading to the removal of game catalog items and the WordPress posts created for them. The loss is data integrity and availability, as administrative control over the catalog is compromised.

WordPress sites running the Games Catalog plugin by askywhale, version 1.2.0 or earlier. No other products are affected.

The CVSS score of 4.3 places this vulnerability in the moderate range. EPSS data is not available, and it is not listed in CISA’s KEV catalog. The likely attack vector is social engineering; an attacker must convince an administrator to click a malicious link, which then triggers the delete action when the plugin mistakenly accepts the request without verification. Because the flaw is not network‑exposed on its own, exploitation requires that the target site has an admin user who can be induced to open the crafted URL. The impact is limited to deletion of catalog data, but it can effectively erase user content and disrupt site functionality.