Platform
wordpress
Component
cms-fuer-motorrad-werkstaetten
Fixed in
1.0.1
1.0.1
CVE-2026-6451 describes a Cross-Site Request Forgery (CSRF) vulnerability discovered in the cms-fuer-motorrad-werkstaetten plugin for WordPress. This flaw allows an attacker to perform unauthorized actions, specifically data deletion, on a user's behalf without their knowledge. The vulnerability impacts versions of the plugin up to 1.0.0, and a fix is expected to be released by the plugin developer.
The primary impact of CVE-2026-6451 is the potential for unauthorized data deletion within the WordPress site using the cms-fuer-motorrad-werkstaetten plugin. An attacker could craft malicious links or scripts that, when clicked by an authenticated user, would trigger the deletion of vehicles, contacts, suppliers, receipts, positions, catalogs, stock items, or catalog settings. This could lead to significant data loss, disruption of business operations, and potential reputational damage. The lack of nonce validation and capability checks makes exploitation relatively straightforward, particularly if the attacker can trick a user into clicking a malicious link.
CVE-2026-6451 was publicly disclosed on 2026-04-17. There are currently no known public proof-of-concept exploits available, but the vulnerability's simplicity suggests that one could be developed relatively easily. The vulnerability is not currently listed on CISA KEV, and there is no evidence of active exploitation campaigns. The CVSS score of 4.3 (Medium) reflects the potential impact and ease of exploitation.
Exploit Status
EPSS
0.01% (2% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2026-6451 is to upgrade the cms-fuer-motorrad-werkstaetten plugin to a version that includes the necessary nonce validation and capability checks. If upgrading is not immediately possible due to compatibility issues or breaking changes, consider implementing a Web Application Firewall (WAF) rule to block requests to the vulnerable AJAX endpoints (vehiclescfmwdvehicle, contactscfmwdcontact, supplierscfmwdsupplier, receiptscfmwdreceipt, positionscfmwdposition, catalogscfmwdarticle, stockcfmwditem, and settingscfmwdcatalog) that lack proper authentication. Additionally, restrict access to the plugin's administrative interface to trusted users only. After upgrading, confirm the fix by attempting to access the vulnerable endpoints while logged in as a standard user and verifying that the actions are denied.
No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2026-6451 is a Cross-Site Request Forgery (CSRF) vulnerability in the cms-fuer-motorrad-werkstaetten WordPress plugin, allowing attackers to delete data without authentication.
You are affected if your WordPress site uses the cms-fuer-motorrad-werkstaetten plugin and is running a version prior to the patched release.
Upgrade the cms-fuer-motorrad-werkstaetten plugin to the latest version that includes nonce validation and capability checks. Consider a WAF rule as a temporary workaround.
There is currently no evidence of active exploitation, but the vulnerability's simplicity suggests potential for future exploitation.
Refer to the plugin developer's website or WordPress plugin repository for the official advisory and update information.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.