Twitter‑Clone 1 exposes a cross‑site request forgery (CWE‑352) that lets an attacker force an authenticated victim to delete arbitrary posts. By crafting a hidden HTML form that targets the tweetdel.php endpoint with specific tweet IDs, the attacker can trigger a deletion when the victim’s browser submits it automatically. The effect is loss of content and compromise of data integrity for an affected user session, but it does not grant remote code execution or data exfiltration. The vulnerability requires the victim to be logged in and the attacker to supply a malicious form, making the impact limited to users who have visited the attacker’s page while authenticated.

The product affected is Fyffe’s PHP‑Twitter‑Clone, specifically version 1 of the application. No additional version range was supplied, so any deployment of this clone is potentially vulnerable.

The CVSS base score of 5.3 indicates moderate severity; the EPSS score is not provided and the vulnerability is not listed in the CISA KEV catalog. Exploitation is possible remotely via a web page that hosts a hidden form and automatically submits a POST request to tweetdel.php. The attacker needs to entice a user to load the malicious page while authenticated. No additional system or network prerequisites are stated, so any web‑browser session that can reach the application is a potential target.