The Alfie – Feed Plugin for WordPress suffers from a CSRF vulnerability due to lack of nonce validation in the alfie_manage() function responsible for handling feed deletions. Attackers can exploit this by crafting malicious requests that, when executed by an authenticated administrator, result in deletion of plugin feed data stored in multiple database tables (alfie_colindex, alfie_producten, alfie_reactions, alfie_searchproduct). This vulnerability affects all plugin versions up to 1.2.1. The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low complexity, no privileges required, but requiring user interaction. There is no vendor advisory or patch information available, and no known active exploitation has been reported.

Successful exploitation allows an attacker to delete arbitrary feed data managed by the plugin, potentially disrupting plugin functionality and data integrity. The impact is limited to integrity loss of plugin-specific data; there is no direct confidentiality or availability impact reported. The attack requires tricking an authenticated administrator into performing the malicious action, which limits the attack scope.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should avoid clicking on suspicious links and consider restricting administrative access or implementing additional CSRF protections at the web server or application level. Monitoring for unusual feed deletion activity may help detect exploitation attempts.