A Cross‑Site Request Forgery flaw in Masa CMS’s trash‑emptying function allows an attacker to trick an authenticated administrator into permanently removing all items in the trash. The exploit bypasses the anti‑CSRF check, leading to irreversible data loss and preventing the recovery of items that the administrator intended to restore.

The vulnerability affects MasaCMS MasaCMS versions 7.5.2 and earlier. Upgrades to 7.2.10, 7.3.15, 7.4.10, or 7.5.3 and later resolve the flaw.

With a CVSS score of 7.2, the flaw presents a moderate to high risk. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting that while exploitation is certainly possible, it may not yet be widely observed. Attackers would need to obtain a session with administrative privileges, which is typically achieved by social engineering or other foothold methods. Once the session is achieved, no additional privileges or complex conditions are required to trigger the deletion.