Thelia Page Module CVE-2026-120207

Exploitation requires an administrator who is concurrently logged in to the Thelia back office in the same browser to perform a top-level navigation to an attacker-supplied GET URL against one of three Page-module delete routes (/admin/page-tag/delete/{id}, /admin/page/document/delete/{docId}/{pageId}, /admin/page/image/delete/{imageId}/{pageId}); these routes lack CSRF tokens, permission checks, and scope checks, and the page-image route resolves the id against the global TheliaLibrary media store so unassociated shop-wide assets are deletable via sequential ids. Default configurations of the bundled Page module <= 2.0.3 are vulnerable - no special feature or setting must be enabled. Limiting factors: the attack needs an active authenticated admin session plus the admin's click/navigation (UI:A), the routes return 403 to session-less requests so embedding as <img src> fails (the top-level navigation is the only vector), and it is blocked once the shop upgrades to 2.0.4.

This is a CWE-352 cross-site request forgery flaw in the Thelia Page module (<= 2.0.3) with a vendor CVSS 4.0 base of 7.0 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N). The signals are internally consistent: network vector, low complexity, no attacker privileges, but mandatory active user interaction (UI:A) - the attacker holds no session and instead rides an authenticated administrator's. Impact is integrity/availability only (no confidentiality): VI:H reflects irreversible deletion of database rows and physical files, VA:L reflects the resulting loss of shop media. No CISA KEV entry and no EPSS score are present in the input, so there is no evidence of active or at-scale exploitation; the vuln.today Decision label is 'this_week' (not act_now/emergency). A detailed, step-by-step public PoC is included in the GitHub Security Advisory (GHSA-whqr-4v2h-6jhc), but the input does not mark it as confirmed working exploit code. Net: a genuinely serious destructive CSRF whose real-world risk is tempered by the UI:A requirement - it needs a logged-in admin to be socially engineered into clicking - rather than a drive-by unauthenticated write. Treat as a this-week priority for Thelia shops running the Page module, not a drop-everything emergency, absent evidence of exploitation.

An attacker hosts a page on any external origin containing a link such as '<a href="http://shop/admin/page/image/delete/7/1">View here</a>' and lures a logged-in Thelia administrator into clicking it. Because the delete routes answer unauthenticated GET navigations with no CSRF token or permission check, the admin's SameSite=Lax session cookie rides the top-level navigation and asset 7 is deleted shop-wide; a lure page with sequential ids becomes a media-library wipe primitive. A detailed public PoC exists in the GHSA advisory, though it is not verified as packaged working exploit code.