What the vulnerability does
01Description
The cms-fuer-motorrad-werkstaetten plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to and including 1.0.0. This is due to missing nonce validation on all eight AJAX deletion handlers: vehicles_cfmw_d_vehicle, contacts_cfmw_d_contact, suppliers_cfmw_d_supplier, receipts_cfmw_d_receipt, positions_cfmw_d_position, catalogs_cfmw_d_article, stock_cfmw_d_item, and settings_cfmw_d_catalog. None of these handlers call check_ajax_referer() or wp_verify_nonce(), nor do they perform any capability checks via current_user_can(). This makes it possible for unauthenticated attackers to delete arbitrary vehicles, contacts, suppliers, receipts, positions, catalog articles, stock items, or entire supplier catalogs via a forged request, provided they can trick a logged-in user into performing an action such as clicking a link to a malicious page.
Explanation of Vulnerability in Simple Terms
02Summary
The CMS für Motorrad Werkstätten plugin is vulnerable to cross-site request forgery (CSRF) attacks. An attacker can craft a malicious webpage that, when visited by a logged-in site administrator, performs unwanted actions on the site without the admin's knowledge or consent. The vulnerability affects all versions up to and including 1.0.0. No patched version is currently available.
What an attacker can do
03Attacker Capabilities
Trick a logged-in admin into performing unwanted actions on the site via a malicious webpage.
Potential impact on your site
04Site Impact
An attacker can modify site settings, create accounts, or change content if an admin visits a compromised page.
Conditions required to exploit
05Prerequisites
Admin must visit a malicious webpage while logged into the site; no special privileges or authentication by the attacker required.
Key dates
06Disclosure timeline
April 17, 2026
CVE published
April 17, 2026
Record updated
