Raytha CMS is vulnerable to Cross‑Site Request Forgery across multiple endpoints. An attacker can host a special website that, when a victim who is already logged into Raytha visits it, automatically sends a POST request to a target endpoint such as one that deletes data. The request bypasses token verification, allowing the attacker to perform privileged actions on behalf of the authenticated user. This vulnerability corresponds to CWE‑352 and directly threatens the integrity of the system by enabling unauthorized data removal.

The affected product is Raytha CMS (Raytha:Raytha). All versions prior to 1.4.6 are vulnerable, as the issue was fixed in version 1.4.6. No additional version specifics are provided in the source data.

The CVSS score of 6.9 indicates moderate severity. An EPSS score of less than 1% suggests a low probability of exploitation in the near term. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a victim to be authenticated and to visit a malicious site, implying a social‑engineering or phishing vector. No additional technical prerequisites are described.