CVE-2026-6451 is a CSRF vulnerability in the tholstkabelbwde WordPress plugin 'CMS für Motorrad Werkstätten' affecting versions up to and including 1.0.0. The issue stems from missing nonce validation and lack of capability checks in eight AJAX deletion handlers, including vehicles_cfmw_d_vehicle and others. Without calls to check_ajax_referer() or wp_verify_nonce(), and without verifying user permissions via current_user_can(), attackers can craft malicious requests that cause logged-in users to delete various data entities within the plugin. This vulnerability requires user interaction (UI:R) but does not require privileges or authentication (PR:N).

An attacker can cause a logged-in user to unknowingly delete critical data such as vehicles, contacts, suppliers, receipts, positions, catalog articles, stock items, or supplier catalogs by exploiting the CSRF vulnerability. This results in integrity loss (I:L) but does not impact confidentiality or availability. The attack vector is network-based and requires user interaction, with low attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should consider disabling or restricting access to the affected AJAX deletion handlers or applying custom nonce and capability checks to prevent unauthorized requests. Monitoring for suspicious deletion activity may help detect exploitation attempts.