Executive brief
The Alfie – Feed Plugin for WordPress, which is used to manage product and data feeds, contains a security flaw that allows attackers to delete feed data. By tricking a site administrator into clicking a malicious link, an attacker can remotely trigger the deletion of important plugin information, including product indexes and reactions. This could lead to data loss and disruption of the website's feed-related functionalities.
Technical details
The Alfie – Feed Plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) due to missing nonce validation in the alfie_manage() function. This function processes feed deletions via the 'delete' GET parameter without verifying the request's authenticity. An unauthenticated attacker can exploit this by inducing a site administrator to perform an action, such as clicking a link, which then executes a forged request. Successful exploitation allows the attacker to delete data from several database tables, including alfie_colindex, alfie_producten, alfie_reactions, and alfie_searchproduct.
Affected products
- Alfie Alfie – Feed Plugin Up to, and including, 1.2.1
Timeline
- 2026-05-22: advisory: NVD publication date
- 2026-05-22: disclosed: Wordfence disclosure date
References
- https://plugins.trac.wordpress.org/browser/alfie-the-productfeedtool-wp-plugin/tags/1.2.1/include/alfie-manage.php
- https://plugins.trac.wordpress.org/browser/alfie-the-productfeedtool-wp-plugin/tags/1.2.1/include/alfie-manage.php
- https://plugins.trac.wordpress.org/browser/alfie-the-productfeedtool-wp-plugin/trunk/include/alfie-manage.php
- https://plugins.trac.wordpress.org/browser/alfie-the-productfeedtool-wp-plugin/trunk/include/alfie-manage.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/af36719a-8f7d-46dc-a697-cfcbb08e45e2?source=cve