Thelia Page Module versions prior to 2.0.4 contain a cross‑site request forgery weakness that lets a remote attacker trigger delete operations on page tags, documents and images. The vulnerable back‑office routes do not enforce CSRF tokens or appropriate permission checks, allowing crafted GET requests to remove content. The deletion removes not only the database entries but also associated files and file variants across pages, products and categories, resulting in permanent data loss and potential site downtime.

The vulnerability is limited to the Thelia Page Module as supplied by Thelia. All releases before 2.0.4 are affected; upgrading to 2.0.4 or later removes the exposed delete routes or adds the required CSRF checks.

The CVSS score of 7 indicates a high severity level. The EPSS score is unavailable, and the vulnerability is not listed in CISA KEV, suggesting no known widespread exploitation yet. Attackers can compromise a logged‑in administrator by luring them to follow crafted URLs that iterate numeric identifiers; no local privilege or code execution is required beyond the victim's authenticated session.