The vulnerability is a CSRF flaw that permits an attacker to perform actions on behalf of an authenticated user in Drupal Frontend Editing. By issuing a crafted request from a malicious site, the attacker can modify or delete content without user consent, exploiting the weakness labeled CWE‑352.

Drupal Frontend Editing is impacted. All versions from 0.0.0 through 1.9.3 are vulnerable; any installation that exposes the front‑end editing interface to web users is at risk.

The flaw can be triggered over the web with no special credentials beyond a user’s authenticated session. Because the attack requires only a forged HTTP request, it is straightforward to automate. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, indicating that while exploitation potential exists, widespread public use has not yet been documented. The web‑based nature of the attack keeps the risk moderate to high, especially in environments with permissive editing permissions.