Technical impact
phpMyFAQ deployments older than 4.1.10 have a vulnerability that allows an attacker who can solve the CAPTCHA challenge to manipulate visitor submitted questions. By providing any openQuestionID in a POST request to /api/faq/create, the attacker can alter question categories, insert fabricated answered entries into faqquestion_history, or permanently delete questions if the records.enableDeleteQuestion setting is active. The flaw is an object‑level authorization bypass classified as CWE‑639.
Affected Systems
The affected systems are installations of phpMyFAQ prior to version 4.1.10. No specific sub‑versions are listed, so any release before the stated threshold is vulnerable unless patched.
Risk and Exploitability
The CVSS score of 8.7 indicates a high severity. Although EPSS evidence is not available, a lack of entries in the KEV catalog suggests no known active exploitation yet. The attack requires unauthenticated access to the API endpoint followed by CAPTCHA completion, which raises the effort of intrusion but still permits a determined attacker to modify or delete user content with relative ease.
