PT-2026-42724 · WordPress · Alfie – Feed Plugin

Published 2026-05-22 · Updated 2026-05-22 · CVE-2026-4070

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Alfie – Feed Plugin for WordPress versions prior to 1.2.2

Description Cross-Site Request Forgery occurs due to missing nonce validation in the alfie manage() function, which handles feed deletion through the 'delete' GET parameter. This allows unauthenticated attackers to delete arbitrary plugin feed data from the alfie colindex, alfie producten, alfie reactions, and alfie searchproduct tables by tricking a site administrator into clicking a forged link. Nonce validation is a security mechanism used to ensure that a request was intentionally sent by the user and not forged by a third party.

Recommendations Update to a version newer than 1.2.1. As a temporary workaround, restrict access to the alfie manage() function until the update is applied.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2026-4070

Affected Products

Alfie – Feed Plugin

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-4070 · Security Note
• https://plugins.trac.wordpress.org/browser/alfie-the-productfeedtool-wp-plugin/trunk/include/alfie-manage.php#L58 · Note
• https://plugins.trac.wordpress.org/browser/alfie-the-productfeedtool-wp-plugin/tags/1.2.1/include/alfie-manage.php#L58 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/af36719a-8f7d-46dc-a697-cfcbb08e45e2?source=cve · Note
• https://twitter.com/CVEnew/status/2057783173648392500 · Twitter Post
• https://plugins.trac.wordpress.org/browser/alfie-the-productfeedtool-wp-plugin/trunk/include/alfie-manage.php#L60 · Note
• https://plugins.trac.wordpress.org/browser/alfie-the-productfeedtool-wp-plugin/tags/1.2.1/include/alfie-manage.php#L60 · Note