CVE-2026-6451

OVERVIEW CVE-2026-6451 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the cms-fuer-motorrad-werkstaetten WordPress plugin through version 1.0.0. The plugin fails to implement nonce validation or capability checks across eight AJAX deletion handlers, allowing attackers to manipulate critical database operations including deletion of vehicles, contacts, suppliers, receipts, positions, catalog articles, stock items, and entire supplier catalogs. SEVERITY The vulnerability carries a CVSS v3.1 score of 4.3 (Medium) with a network attack vector and low complexity. Exploitation requires user interaction, as an attacker must trick a logged-in administrator into visiting a malicious page. While the attack requires no special privileges, the impact is limited to data integrity through unauthorized deletion, with no confidentiality or availability concerns. The absence of authentication checks means any unauthenticated attacker can craft malicious requests, though effectiveness depends on an authenticated user being present. EXPLOITATION STATUS This vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog and shows no evidence of active exploitation in the wild. The EPSS score of 0.00012 indicates minimal real-world exploitation probability. The vulnerability remains on an Inactive Hot List status, suggesting limited community awareness or immediate threat. No public exploit code has been widely distributed, though the straightforward nature of CSRF attacks means exploitation would be relatively trivial for motivated threat actors.