Technical impact
YesWiki versions prior to 4.7.0 are vulnerable to a CSRF flaw in the despam action. An unauthenticated attacker can embed an auto‑submitting form that posts the suppr[] or rev[] parameters with a target page, causing an administrator's browser to issue a request that deletes, restores or overwrites content such as the homepage, configuration pages or other critical pages. This flaw does not require the attacker to supply valid credentials but relies on the administrator legitimately visiting a page containing the form.
Affected Systems
The vulnerability affects the YesWiki content‑management system, specifically all releases before 4.7.0. The affected vendor is YesWiki and the product is YesWiki. Versions 3.x, 4.0–4.6 are all impacted; precise version numbers are not listed in this advisory, but the issue is resolved in 4.7.0 and later.
Risk and Exploitability
The issue carries a CVSS score of 7.2, indicating a moderate to high risk. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by simply planting a malicious HTML form on any page; if an administrator views the page, the destructive action is triggered. Because the exploit requires the administrator to visit a page with the form, the risk is moderate, but the impact can be significant for sites where administrators regularly edit or moderate pages.
