CVE-2026-8418: Games Catalog Plugin CSRF Vulnerability

CVE-2026-8418 Overview

The Games Catalog plugin for WordPress contains a Cross-Site Request Forgery (CSRF) vulnerability in versions up to and including 1.2.0. The flaw resides in the gc_crud() function, which handles delete operations via GET requests without nonce validation. Unauthenticated attackers can craft malicious links that, when clicked by an authenticated administrator, delete arbitrary game catalog entries and their associated WordPress posts. The vulnerability is tracked under [CWE-352] (Cross-Site Request Forgery).

Critical Impact

Attackers can delete arbitrary game catalog entries and associated WordPress posts by tricking a site administrator into clicking a crafted link.

Affected Products

• Games Catalog plugin for WordPress
• Versions up to and including 1.2.0
• All WordPress installations with the vulnerable plugin enabled

Discovery Timeline

• 2026-05-20 - CVE CVE-2026-8418 published to NVD
• 2026-05-20 - Last updated in NVD database

Technical Details for CVE-2026-8418

Vulnerability Analysis

The vulnerability stems from missing CSRF protection in the gc_crud() function within the Games Catalog plugin's administrative code. When the plugin processes the delete action through a GET request containing action=delete, it fails to invoke wp_verify_nonce() or check_admin_referer() before executing the destructive operation. This omission means the server cannot distinguish between a legitimate administrator-initiated request and a forged request originating from an attacker-controlled page.

Attackers exploit this gap by hosting a malicious URL or embedding an image tag pointing to the vulnerable endpoint. When an authenticated administrator visits the attacker-controlled content, the browser automatically submits the request using the administrator's active session cookies. The plugin executes the delete operation, removing the targeted game catalog entry and its associated WordPress post.

Root Cause

The root cause is the absence of nonce validation in the delete handler. WordPress provides wp_verify_nonce() and check_admin_referer() specifically to prevent CSRF attacks against state-changing operations. The gc_crud() function in admin-crud.php processes the action=delete parameter from a GET request without enforcing either control. Relying solely on session authentication leaves the action vulnerable to cross-origin request forgery.

Attack Vector

Exploitation requires social engineering. An attacker crafts a URL containing the delete action parameters and persuades an administrator to click the link, view a page containing a hidden <img> tag pointing to the URL, or visit an attacker-controlled site that auto-submits the request. No authentication is required from the attacker. The administrator's authenticated browser session performs the unauthorized deletion. Refer to the Wordfence Vulnerability Analysis and the WordPress Plugin Code Reference for the vulnerable code path.

Detection Methods for CVE-2026-8418

Indicators of Compromise

• Unexpected deletion of game catalog entries or associated WordPress posts without corresponding administrator activity logs
• Web server access logs showing GET requests to plugin endpoints containing action=delete parameters originating from external referrers
• Administrator session activity immediately following clicks on external links or visits to untrusted sites

Detection Strategies

• Audit WordPress access logs for GET requests to Games Catalog plugin URLs with action=delete and inspect the HTTP Referer header for off-site origins
• Compare current game catalog inventory against known-good backups to identify unauthorized removals
• Deploy a Web Application Firewall (WAF) rule to flag state-changing GET requests lacking valid nonce parameters

Monitoring Recommendations

• Enable WordPress activity logging plugins to capture administrator actions and content deletions with timestamps and source IPs
• Monitor for anomalous spikes in post deletions correlated with administrator session activity
• Alert on requests to plugin admin endpoints that lack the _wpnonce query parameter

How to Mitigate CVE-2026-8418

Immediate Actions Required

• Update the Games Catalog plugin to a version newer than 1.2.0 as soon as a patched release becomes available
• Disable or deactivate the Games Catalog plugin if a patched version is not yet published
• Instruct administrators to log out of WordPress sessions before browsing untrusted websites or clicking unknown links

Patch Information

At the time of publication, no fixed version has been listed in the NVD entry. Site operators should monitor the Wordfence Vulnerability Analysis and the plugin repository for an updated release containing nonce validation in gc_crud().

Workarounds

• Restrict access to the WordPress admin interface using IP allowlisting at the web server or WAF layer to reduce CSRF exposure
• Deploy a WAF rule that blocks GET requests containing action=delete to Games Catalog plugin paths unless they include a valid _wpnonce parameter
• Maintain regular database and content backups so deleted catalog entries can be restored quickly

# Example WAF rule (ModSecurity) to block delete actions without a nonce
SecRule REQUEST_URI "@contains /wp-admin/" \
  "chain,deny,status:403,id:1026841801,msg:'CVE-2026-8418 CSRF block'"
  SecRule ARGS:action "@streq delete" \
    "chain"
    SecRule &ARGS:_wpnonce "@eq 0"