The Grav Guestbook Plugin 0.5.0 and 0.5.1 lack proper authorization checks and CSRF protection for moderation actions such as delete, approve, and approveAll. Authenticated admin users without the admin.guestbook permission, or attackers spoofing a moderator session, can delete or approve guestbook entries via simple GET requests. This flaw allows an attacker to manipulate user content and potentially erase or publish unwanted entries.

The vulnerability affects the Grav Guestbook Plugin version 0.5.0 and 0.5.1 distributed by getgrav. Systems running these plugin versions are susceptible.

The CVSS score is 5.3, indicating a moderate severity. EPSS is not reported, and the issue is not listed in CISA KEV. Attackers require a valid admin session, but the absence of the admin.guestbook permission check allows privileged users to perform moderation without authorization, and the lack of CSRF tokens enables external sites to trigger changes through GET requests. The risk is primarily to content integrity and availability, and it can be exploited by anyone who can obtain or hijack an admin session.