Junglewise Threat Intelligence

CVE-2026-4070: Alfie Feed Plugin CSRF in alfie_manage

CVE-2026-4070 · Severity: medium · CVSS 4.3 · Published 2026-05-22

Executive brief

The Alfie – Feed Plugin for WordPress, which is used to manage product and data feeds, contains a security flaw that allows attackers to delete feed data. By tricking a site administrator into clicking a malicious link, an attacker can remotely trigger the deletion of important plugin information, including product indexes and reactions. This could lead to data loss and disruption of the website's feed-related functionalities.

Technical details

The Alfie – Feed Plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) due to missing nonce validation in the alfie_manage() function. This function processes feed deletions via the 'delete' GET parameter without verifying the request's authenticity. An unauthenticated attacker can exploit this by inducing a site administrator to perform an action, such as clicking a link, which then executes a forged request. Successful exploitation allows the attacker to delete data from several database tables, including alfie_colindex, alfie_producten, alfie_reactions, and alfie_searchproduct.

Affected products

  • Alfie Alfie – Feed Plugin Up to, and including, 1.2.1

Timeline

  • 2026-05-22: advisory: NVD publication date
  • 2026-05-22: disclosed: Wordfence disclosure date

References