The vulnerability involves improper authorization in the delete function of the Trade Address Deletion endpoint in Sanluan PublicCMS. An attacker can manipulate the ids parameter to delete trade addresses that do not belong to them, resulting in data loss and potential account manipulation. This issue is classified as improper authorization (CWE‑266 and CWE‑285) and carries a CVSS score of 5.3.

Affected systems include Sanluan PublicCMS version 5.202506.d and earlier. The vulnerability resides in the publiccms-trade component within the TradeAddressController class, exposing an HTTP endpoint that can be accessed remotely.

The exploit is publicly available and can be triggered remotely by sending crafted HTTP requests to the delete endpoint. The EPSS score of less than 1% indicates a low likelihood of widespread exploitation, and the vulnerability is not listed in the CISA KEV catalog. However, because the attack vector is remote and the damage can be significant, monitoring and mitigation are recommended.