Emlog versions before 2.6.11 lack CSRF protection in key administrative interfaces, permitting a malicious actor to deceive an authenticated administrator into executing privileged operations such as system registration, plugin installation or modification, and configuration changes. This flaw enables an attacker to alter the website’s behavior or introduce malicious code without the administrator’s consent, thereby compromising the confidentiality, integrity, or availability of the site.

The affected platform is the open‑source Emlog website builder, with any installation running a version earlier than 2.6.11 vulnerable. The vulnerability is specifically tied to the administrator functions within the system, and is present in all releases prior to the patched 2.6.11 checkout.

The CVSS score of 8.4 categorizes this issue as high severity. While an EPSS score is not available, the lack of an exploit listing in the CISA KEV catalog suggests no known large‑scale exploitation yet. The likely attack vector is a crafted HTTP request that the victim’s browser submits automatically, requiring the attacker only to entice the administrator into visiting a malicious site or clicking a link. Successful exploitation would grant the attacker any capabilities the compromised administrator possesses, until the patch is applied.