Executive brief
The Plugins Garbage Collector (Database Cleanup) is a WordPress plugin that helps clean up unused database entries. An unauthenticated attacker can trick a logged-in website administrator into performing unintended actions by crafting a malicious webpage or email link, potentially leading to unauthorized plugin deletion, database corruption, or other harmful configuration changes.
Technical details
This is a Cross-Site Request Forgery (CSRF) vulnerability in the Plugins Garbage Collector WordPress plugin affecting versions 0.14 and earlier. The plugin lacks proper CSRF token validation on its administrative actions, allowing an attacker to craft a malicious request that, when visited by an authenticated administrator, executes unintended plugin operations without their consent. The vulnerability requires user interaction (an administrator must visit a crafted link or webpage), but no authentication is required from the attacker. Successful exploitation could allow deletion of plugins, manipulation of plugin settings, or corruption of the WordPress database. The vulnerability has been patched in version 0.15 and later.
Affected products
- WordPress Plugins Garbage Collector <= 0.14
Timeline
- 2026-08-06: disclosed: Published by Patchstack
- 2026-08-06: patched: Version 0.15 released with fix
- 2026-08-06: advisory