The MainWP Dashboard plugin for WordPress, used for managing multiple websites, contains a CSRF vulnerability due to improper nonce validation in the 'posting_bulk' function. This flaw enables attackers to perform unauthorized post deletion if they can deceive an authenticated site administrator into executing a crafted request. The vulnerability affects all versions up to and including 4.6.0.1. The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low complexity, no privileges required, but requiring user interaction. The impact is limited to availability (deletion of posts) without confidentiality or integrity compromise. No patch or official fix information is currently available.

An attacker can cause deletion of arbitrary posts on a vulnerable MainWP Dashboard installation by exploiting the CSRF vulnerability. This impacts the availability of content managed through the plugin but does not affect confidentiality or integrity of data. The attack requires tricking an authenticated administrator into performing an action, such as clicking a malicious link.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should exercise caution when interacting with untrusted links or websites while logged into the MainWP Dashboard. Monitoring vendor channels for updates is recommended.