The {{erasespamedcomments}} action in YesWiki accepts a POST array of page tags and deletes each referenced page without performing any authorization checks. This lack of access control means any authenticated user with write permissions, which for a fresh install defaults to all users, can arbitrarily delete any wiki page—including the front page, administrative pages, and pages owned by other users—resulting in irreversible data loss and denial of service for the target wiki.

YesWiki platforms running any version prior to 4.6.6 are vulnerable. The vulnerability was fixed in the 4.6.6 release, so installations using 4.6.5 or earlier, or any unreleased code that includes the unpatched EraseSpamedCommentsAction.php, are affected.

The CVSS v3 score of 9.1 classifies this flaw as critical, and it is listed as not present in CISA’s KEV catalog. Although its EPSS score is unavailable, the vulnerability can be abused with a simple POST request once a user has write access; in the default ACL configuration any user can trigger it. An attacker can therefore delete arbitrary content, disrupt wiki operations, and potentially erase administrative configuration, leading to a severe compromise of the wiki’s availability and integrity.