CVE-2026-8418 is a CSRF vulnerability in the askywhale Games Catalog WordPress plugin (up to version 1.2.0). The vulnerability exists because the gc_crud() function, responsible for handling delete actions via GET requests, lacks proper nonce validation (no wp_verify_nonce() or check_admin_referer() calls). This allows unauthenticated attackers to perform unauthorized deletions of game catalog entries by tricking an administrator into executing a forged request. The vulnerability does not require privileges or authentication but does require user interaction (UI:R). The CVSS 3.1 base score is 4.3, reflecting low attack complexity and limited impact (integrity loss only). No vendor patch or official fix has been published as of the data provided.

Successful exploitation allows an attacker to delete arbitrary game catalog entries and their associated WordPress posts without authentication, by leveraging an administrator's interaction with a crafted request. This results in integrity loss of the affected data. There is no confidentiality or availability impact reported. No known active exploits have been observed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid clicking on untrusted links while logged into WordPress with administrative privileges. Implementing manual nonce verification or restricting delete actions to POST requests with proper nonce checks can mitigate the risk. Monitoring plugin updates from askywhale for an official patch is recommended.