The Alfie – Feed Plugin for WordPress suffers from a CSRF vulnerability due to the absence of nonce validation in the alfie_manage() function. This function handles feed deletion through a 'delete' GET parameter, allowing attackers to craft forged requests that, when executed by an authenticated administrator, result in deletion of plugin feed data stored in multiple tables (alfie_colindex, alfie_producten, alfie_reactions, alfie_searchproduct). The vulnerability affects all versions up to 1.2.1. The CVSS 3.1 base score is 4.3, reflecting a medium impact primarily on integrity with no confidentiality or availability impact. No vendor-provided patch or official remediation is currently documented.

Successful exploitation allows an attacker to delete arbitrary feed data managed by the plugin without authentication, by leveraging an administrator's interaction with a maliciously crafted link. This impacts the integrity of the plugin's data but does not affect confidentiality or availability. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should be cautious about clicking on untrusted links while logged into WordPress with administrative privileges. Implementing manual nonce validation or other CSRF protections in the plugin code may mitigate the risk if feasible.