In Masa CMS versions 7.5.2 and earlier, the function that updates user address information fails to validate cross‑site request forgery (CSRF) tokens. An attacker who can coerce a logged‑in administrator into submitting a forged HTTP request can add, modify, or delete addresses, phone numbers, and e‑mail addresses. This direct manipulation of user data can change contact information, redirect communications, and corrupt the user directory. The flaw is a classic CSRF weakness and is classified as CWE‑352.

The vulnerability affects the MasaCMS product only. All releases up to and including version 7.5.2 are impacted; the bug was fixed in 7.2.10, 7.3.15, 7.4.10 and 7.5.3. Users should verify they are running a supported, patched release.

The CVSS score of 7.1 indicates high severity, but the EPSS score is not available, so the current likelihood of exploitation is unknown. The vulnerability is not listed in CISA’s KEV catalog. Relying on the official advisory, the attack requires the victim to be authenticated to the administrative backend and then be tricked into submitting a forged request. An attacker can craft a malicious link or form to trigger the unauthenticated operation. The lack of token validation makes the exploit straightforward for an attacker with social engineering capability or a compromised host.