The vulnerability occurs in the file_download.php script of the Weno module where no access control or CSRF verification is performed. Any authenticated user can invoke a request that calls PharmacyService::removeWenoPharmacies(), which truncates the weno_pharmacy database table. The result is an empty e‑prescribing pharmacy directory, effectively disabling delivery of prescriptions and causing data loss. Cross‑site requests from a logged‑in victim can also trigger the same operation, potentially affecting multiple users if the attacker can lure victims to a malicious site.

This flaw exists in OpenEMR deployments prior to version 8.3.0 that have the Weno module enabled. The affected code is located under interface/modules/custom_modules/oe-module-weno/scripts/file_download.php. Only installations that include the Weno module and grant users authentication are at risk.

The CVSS score is 5.4, indicating a moderate severity. No EPSS score is published, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no widespread exploitation so far. Attackers would need authenticated access or the ability to forge a request from a logged‑in user. The absence of authorization checks makes the flaw straightforward to exploit once authentication is obtained, though it does not allow arbitrary code execution.