A cross‑site request forgery flaw in the cUsers.updateAddress routine allows a malicious site to send requests that add, modify, or delete addresses on behalf of a logged‑in administrator. The attack can inject attacker‑controlled email or phone numbers, overwrite legitimate addresses, or remove them entirely, thereby corrupting business communication channels and exposing sensitive contact information. The vulnerability leverages missing CSRF token validation and directly affects the integrity of user address records within MuraCMS.

The weakness exists in MuraCMS up to and including version 10.1.10; earlier releases are also impacted, as the issue was not fixed until the 10.1.10 release notes explain the update. Administrators using MuraCMS 10.1.10 or earlier are at risk, regardless of the specific deployment location.

The CVSS score of 7.1 indicates a high severity condition. EPSS shows a probability of exploitation below 1 %, and the flaw is not present in CISA’s Known Exploited Vulnerabilities list. Exploitation requires an authenticated administrator who inadvertently visits a malicious website; the attacker therefore exploits the lack of CSRF validation during an active session. Once the request is sent, the attacker can alter user data with the administrator’s privileges.