Description

Unauthenticated Cross Site Request Forgery (CSRF) in Plugins Garbage Collector (Database Cleanup) <= 0.14 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-06T15:17:21.973Z",
  "pubdate": "2026-08-06T15:17:21.973Z",
  "executiveSummary": "An unauthenticated Cross-Site Request Forgery (CSRF) vulnerability has been identified in the Plugins Garbage Collector (Database Cleanup) plugin, affecting all versions up to and including 0.14. This security flaw enables remote attackers to trick authenticated administrative users into unknowingly executing unauthorized state-changing operations via crafted malicious web pages.\nThe primary impact of this vulnerability involves the potential unauthorized execution of administrative actions within the affected WordPress environment. Since the target functionality is exposed to administrative privileges, successful exploitation allows an attacker to leverage the victim's active session to perform unintended database cleanup routines or alter plugin configurations without the administrator's consent.\nThe affected product is the Plugins Garbage Collector (Database Cleanup) plugin for versions <= 0.14. Risk implications include the degradation of system integrity and potential unauthorized data modification or deletion resulting from forced administrative actions.\nAttacker capabilities are constrained by the requirement to interact with a legitimate administrative user. The primary exploitation requirement is that an authenticated administrator must visit an attacker-controlled website or view a malicious resource while holding an active, valid administrative session on the vulnerable WordPress site.",
  "technicalDetails": "The vulnerability resides in the request handling mechanism of the Plugins Garbage Collector (Database Cleanup) plugin for versions <= 0.14, specifically stemming from a failure to implement robust anti-CSRF mechanisms, such as cryptographic nonces, on sensitive state-changing endpoints.\nRoot Cause: The lack of validation for anti-CSRF tokens in the request handling lifecycle allows external web applications to forge requests that the server interprets as legitimate actions initiated by an authenticated user.\nAuthentication Requirements: No authentication is required for the attacker to initiate the attack; however, the victim must possess administrative privileges and have an active session with the vulnerable application.\nPrivilege Requirements: The exploitation relies on the implicit administrative privileges of the victimized user session to execute restricted operations.\nNetwork Exposure: The vulnerability is exploitable over the network via standard HTTP/HTTPS protocols when a user with administrative privileges accesses a malicious context.\nAttack Flow and Exploitation Method: 1. The attacker crafts a malicious HTML document or script containing a forged HTTP request (e.g., via an auto-submitting form or an asynchronous JavaScript request) targeted at the vulnerable administrative endpoint within the Plugins Garbage Collector (Database Cleanup) plugin. 2. The attacker lures an authenticated administrator of the target WordPress installation to the malicious webpage or embeds the exploit payload within a compromised site. 3. The victim's browser automatically includes any valid, active cookies associated with the target WordPress site when dispatching the forged request to the vulnerable endpoint. 4. Due to the absence of proper request verification tokens, the server processes the incoming request as a legitimate administrative command. 5. The application executes the intended database cleanup or configuration action defined by the attacker's payload, resulting in unauthorized state changes within the target environment."
}