Vulnerability · Published Oct 31, 2026 · Assigned by VulnCheck

CVE-2026-120207Thelia Page Module before 2.0.4 CSRF via Page Tag, Document and Image Delete Routes

High 7.1

In plain English

A high-severity cross-site request forgery in Thelia Page Module from Thelia. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).

Severity (CVSS 3.1)7.1High

Exploit odds (30 days)0.2%top 89.7% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Thelia Page Module before 2.0.4 contains a cross-site request forgery vulnerability that allows remote attackers to delete page tags, documents and images by abusing back-office delete routes lacking CSRF tokens and permission checks. Attackers can lure a logged-in administrator into navigating to crafted GET requests that walk sequential ids, removing TheliaLibrary images, their files and variants across pages, products and categories.

Affected products (as reported)

Vendor	Product	Versions
Thelia	Thelia Page Module	0 – before 2.0.4

Weakness: CWE-352 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L

References

GitHub Security Advisory (GHSA-whqr-4v2h-6jhc) vendor-advisory, third-party-advisory
https://github.com/thelia-modules/Page/commit/e7206a7c35c945cc8fe529fe95a9b30402f0fb60 patch
https://github.com/thelia-modules/Page/blob/2.0.3/Controller/Admin/PageImageController.php#L117 technical-description
VulnCheck Advisory: Thelia Page Module before 2.0.4 CSRF via Page Tag, Document and Image Delete Routes third-party-advisory