A missing CSRF token validation in the cTrash.empty function permits attackers to craft a malicious webpage that, when visited by an authenticated administrator, causes the browser to automatically submit a hidden form and permanently empty the entire trash system. The loss is irreversible and can be catastrophic for the CMS, as all deleted content is permanently removed without confirmation or user consent. This flaw is categorized as Cross‑Site Request Forgery (CWE‑352).

All installations of MuraCMS up to and including version 10.1.10 are affected. The Vendor is MuraSoftware and the product is MuraCMS. Users should verify their version and consider upgrading if they are running 10.1.10 or older.

The vulnerability carries a high CVSS score of 8.1 and a low EPSS probability of less than 1%, and it has not been registered in the CISA KEV catalog. Exploitation requires that an attacker convince an authenticated administrator to visit a malicious page; no special system permissions are needed beyond the administrator’s credentials. An attacker can trigger the deletion by simply loading the crafted page, making the risk substantial for any site with logged‑in admins. The impact is confined to the CMS’s deleted‑content area, but the loss of data is permanent and could compromise business continuity.