WordPress Games Catalog Plugin Cross-Site Request Forgery Vulnerability Allowing Arbitrary Deletion

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the Games Catalog plugin for WordPress, affecting versions through 1.2.0. The issue arises from inadequate nonce validation in the gc_crud() function, which manages deletion actions via GET requests without proper verification. This flaw enables unauthenticated attackers to delete any game catalog entries, along with the corresponding WordPress posts, by tricking an administrator into clicking a link.

Impact

Exploitation of this vulnerability allows for the unauthorized deletion of game catalog entries and their associated WordPress posts.