The flaw exists in phpMyFAQ’s API v4.0 where the default empty apiClientToken allows an attacker to bypass authentication by sending an empty x‑pmf‑token header. This bypass enables the creation or modification of FAQ entries via POST requests to /api/v4.0/faq/create, /api/v4.0/category, and /api/v4.0/question. The vulnerability is a classic authentication bypass (CWE‑1188) that permits unauthenticated users to add or alter content, potentially injecting malicious payloads that can be displayed to site visitors. The impact threatens the integrity of the FAQ database and may lead to arbitrary code or content injection.

phpMyFAQ installations using API v4.0 and running a version prior to 4.1.3 are affected. The issue was fixed in release 4.1.3; any earlier version remains vulnerable.

The CVSS score of 8.7 indicates a high severity and the flaw can be exploited remotely over the HTTP API without credentials. The EPSS score is currently unavailable, but the lack of a KEV listing does not reduce the risk; the vulnerability remains actively exploitable. Attackers need only network access to the exposed API endpoints and can send a crafted POST request with an empty token header to create or modify FAQ entries. This straightforward attack vector makes the risk readily exploitable for malicious actors.