CVE-2026-4070

The Alfie – Feed Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.1. This is due to missing nonce validation on the alfie_manage() function which handles feed deletion via the 'delete' GET parameter. This makes it possible for unauthenticated attackers to delete arbitrary plugin feed data (from alfie_colindex, alfie_producten, alfie_reactions, and alfie_searchproduct tables) via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

• CWE-352

• https://plugins.trac.wordpress.org/browser/alfie-the-productfeedtool-wp-plugin/tags/1.2.1/include/alfie-manage.php#L58
• https://plugins.trac.wordpress.org/browser/alfie-the-productfeedtool-wp-plugin/tags/1.2.1/include/alfie-manage.php#L60
• https://plugins.trac.wordpress.org/browser/alfie-the-productfeedtool-wp-plugin/trunk/include/alfie-manage.php#L58
• https://plugins.trac.wordpress.org/browser/alfie-the-productfeedtool-wp-plugin/trunk/include/alfie-manage.php#L60
• https://www.wordfence.com/threat-intel/vulnerabilities/id/af36719a-8f7d-46dc-a697-cfcbb08e45e2?source=cve

Published

May 22, 2026

Last Modified

Jul 23, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-40688An out-of-bounds write vulnerability [CWE-787] vulnerability…7.2
• CVE-2026-4069The Alfie – Feed Plugin plugin for WordPress is vulnerable t…6.1
• CVE-2026-40690The asset dependency graph did not restrict nodes by the vie…4.3
• CVE-2026-40691In Unbound 1.9.0 up to and including 1.25.1, when a DNSCrypt…7.5
• CVE-2026-40698A vulnerability exists in BIG-IP and BIG-IQ systems where a …8.7
• CVE-2026-40699A vulnerability exists in the undisclosed pages in the Confi…7.1
• CVE-2026-40701NGINX Plus and NGINX Open Source have a vulnerability in the…6.3
• CVE-2026-40702WebSocket endpoints lack proper authentication mechanisms, e…9.4
• CVE-2026-40703A cross-site request forgery (CSRF) vulnerability exists in …5.4
• CVE-2026-40706In NTFS-3G 2022.10.3 before 2026.2.25, a heap buffer overflo…8.4
• CVE-2026-4071The BirdSeed plugin for WordPress is vulnerable to Cross-Sit…4.3
• CVE-2026-40711Dell Dell Container Storage Modules, version(s) csi-powersto…8