This vulnerability is a CSRF flaw that enables a malicious web page to trick the target's browser into sending authenticated requests to the Sitemio WISECP system. An attacker with the ability to host a malicious site can trigger actions such as configuration changes, data modification or even privileged operations, depending on the victim's permissions. The flaw is classified as CWE‑352 and carries a CVSS score of 8, indicating high severity.

The flaw affects all versions of Sitemio's WISECP up to and including version 20022026. The vendor has not yet released a patch and did not respond to early disclosure. The product is used by organizations that rely on WISECP for information management.

Because CSRF attacks rely on a victim's authenticated session, the attacker must persuade or trick a user into visiting a malicious site while logged into WISECP. The lack of an official patch makes the precise likelihood uncertain, but the high CVSS score signals a serious risk. The vulnerability is not listed in CISA KEV, so it is not known to have active public exploitation at this time. Nevertheless, the attack can be carried out by manipulating the victim’s browser, especially if the system does not enforce a SameSite cookie policy or active CSRF tokens.