CVE-2026-6451: 
WordPress vulnerability analysis and mitigation

CVE-2026-6451 is a Cross-Site Request Forgery (CSRF) vulnerability in the cms-fuer-motorrad-werkstaetten WordPress plugin, affecting all versions up to and including 1.0.0. The flaw exists across eight AJAX deletion handlers that lack nonce validation and capability checks, allowing unauthenticated attackers to delete business-critical data by tricking a logged-in user into visiting a malicious page. It was published on April 17, 2026, with a CVSS v3.1 base score of 4.3 (Medium) (GitHub Advisory).

The vulnerability is classified as CWE-352 (Cross-Site Request Forgery). The root cause is that all eight AJAX deletion handlers — vehicles_cfmw_d_vehicle, contacts_cfmw_d_contact, suppliers_cfmw_d_supplier, receipts_cfmw_d_receipt, positions_cfmw_d_position, catalogs_cfmw_d_article, stock_cfmw_d_item, and settings_cfmw_d_catalog — fail to call check_ajax_referer() or wp_verify_nonce(), and perform no authorization checks via current_user_can(). An attacker can craft a forged HTTP request targeting any of these handlers and deliver it via a malicious web page; when a logged-in WordPress user visits the page, the browser automatically sends the authenticated session cookies, causing the deletion action to execute without the user's knowledge (GitHub Advisory).

Successful exploitation allows an unauthenticated attacker to permanently delete arbitrary business records managed by the plugin, including vehicles, contacts, suppliers, receipts, positions, catalog articles, stock items, and entire supplier catalogs. The primary impact is on data integrity and availability of business-critical records for motorcycle workshop operators using this plugin. There is no confidentiality impact (no data is exposed to the attacker), and lateral movement beyond the plugin's data scope is not directly enabled (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.011% (1st percentile), indicating a very low probability of exploitation in the near term. No threat actor attribution or CISA KEV catalog listing has been identified for this CVE (GitHub Advisory).

1. Reconnaissance: Identify WordPress sites running the cms-fuer-motorrad-werkstaetten plugin version 1.0.0 or earlier, for example by searching for plugin-specific assets or admin page indicators.
2. Craft malicious page: Create an HTML page containing a hidden form or JavaScript that automatically submits an AJAX POST request to the target WordPress site's wp-admin/admin-ajax.php endpoint, specifying one of the vulnerable actions (e.g., action=vehicles_cfmw_d_vehicle) and a target record ID.
3. Deliver the payload: Trick a logged-in WordPress administrator or editor into visiting the malicious page via phishing email, social engineering, or a compromised third-party site.
4. Trigger deletion: The victim's browser, carrying valid WordPress session cookies, automatically sends the forged request. Because no nonce or capability check is performed, the server processes the deletion and removes the targeted record.
5. Repeat for additional records: The attacker can target any of the eight vulnerable handlers to delete vehicles, contacts, suppliers, receipts, positions, catalog articles, stock items, or entire supplier catalogs (GitHub Advisory).

• Logs: WordPress access logs showing unexpected POST requests to wp-admin/admin-ajax.php with action parameters matching vehicles_cfmw_d_vehicle, contacts_cfmw_d_contact, suppliers_cfmw_d_supplier, receipts_cfmw_d_receipt, positions_cfmw_d_position, catalogs_cfmw_d_article, stock_cfmw_d_item, or settings_cfmw_d_catalog from unusual referrer origins or IP addresses.
• Application: Unexplained mass deletion of plugin-managed records (vehicles, contacts, suppliers, receipts, stock items, catalogs) without corresponding admin activity in WordPress audit logs.
• Network: AJAX requests to wp-admin/admin-ajax.php originating from external or unexpected referrer domains rather than the WordPress admin dashboard.

Organizations should update the cms-fuer-motorrad-werkstaetten plugin to a version newer than 1.0.0 as soon as a patched release is available. As an interim measure, consider disabling the plugin entirely until patching is completed, or implement Web Application Firewall (WAF) rules to block suspicious AJAX deletion requests targeting the affected action names. Additionally, educating WordPress users about the risks of clicking unsolicited links while logged into the admin panel reduces the social engineering attack surface (GitHub Advisory).

The vulnerability was noted in automated CVE tracking feeds and aggregators shortly after publication on April 17, 2026, including posts on Bluesky via CVE tracking bots. No significant vendor statements, notable researcher commentary, or major media coverage has been identified beyond standard vulnerability database entries (GitHub Advisory).