Admidio’s module handler accepts GET requests for installing, uninstalling and updating plugins without CSRF protection. This flaw allows a crafted page to trigger those requests, and because the browser supplies the user’s admin session cookie with SameSite=Lax, the server processes them as authenticated actions. Uninstalling a plugin runs DROP TABLE SQL scripts, which can delete all plugin‑related data. The vulnerability is a classic CSRF fault (CWE‑352) that can lead to loss of configuration and data, and potentially compromise the system’s integrity.

The flaw exists in Admidio versions 5.0.11 and earlier. An administrator using the modules/plugins.php endpoint can be impacted. Systems running these specific releases are at risk until the patch is applied or the endpoint is secured.

The CVSS score of 5.2 indicates medium severity, and there is no EPSS data available. The flaw is not listed in the CISA KEV catalog. An attacker can exploit the vulnerability by hosting a malicious site that an authenticated admin visits; the GET request automatically includes the session cookie, enabling the attacker to install, uninstall or update plugins. Since the operation can delete database tables, the potential impact is significant data loss. Appropriate precautions are required until a patch or mitigation is applied.