tholstkabelbwde vulnerabilities and threats

The Plugin: CMS für Motorrad Werkstätten for WordPress contains an SQL Injection vulnerability in the 'arttype' parameter in all versions up to 1.0.0. Authenticated users with subscriber-level access or higher can exploit this flaw to append additional SQL queries, potentially extracting sensitive database information. The vulnerability arises from insufficient escaping and lack of proper query preparation. The CVSS score is 6.5, indicating a medium severity risk. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.

The tholstkabelbwde WordPress plugin 'CMS für Motorrad Werkstätten' versions up to 1.0.0 contains a Cross-Site Request Forgery (CSRF) vulnerability. This arises from missing nonce validation and lack of capability checks on eight AJAX deletion handlers. An attacker can exploit this by tricking a logged-in user into submitting a malicious request, potentially causing deletion of various data such as vehicles, contacts, suppliers, receipts, positions, catalog articles, stock items, or entire supplier catalogs. The vulnerability has a CVSS score of 4.3, indicating medium severity. No official patch or remediation guidance is currently available, and no known exploits are reported in the wild.