Junglewise Threat Intelligence

CVE-2026-8418: WordPress Games Catalog CSRF in gc_crud function

CVE-2026-8418 · Severity: medium · CVSS 4.3 · Published 2026-05-20

Vendors: Wordpress.

Executive brief

The Games Catalog plugin for WordPress, which allows site owners to manage and display a list of games, contains a security flaw that could allow an attacker to delete content. By tricking a site administrator into clicking a malicious link, an attacker can force the website to delete game catalog entries and their associated blog posts. This could lead to unauthorized data loss and disruption of the website's content.

Technical details

The Games Catalog plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) due to missing nonce validation in the gc_crud() function. Specifically, the function handles delete actions (action=delete) via GET requests without implementing security checks like wp_verify_nonce() or check_admin_referer(). An unauthenticated attacker can exploit this by crafting a malicious request and inducing a logged-in administrator to execute it via social engineering (e.g., clicking a link). Successful exploitation results in the deletion of arbitrary game catalog entries and their corresponding WordPress posts.

Affected products

  • WordPress Games Catalog up to, and including, 1.2.0

Timeline

  • 2026-05-20: advisory: NVD publication date

References