Acora CMS Cross-Site Request Forgery Vulnerability

A Cross-Site Request Forgery (CSRF) vulnerability exists in Acora CMS version 10.1.1. This issue allows attackers to manipulate authenticated users into executing unauthorized actions, such as deleting accounts or creating users. The vulnerability arises from insufficient CSRF protections, enabling exploitation through crafted requests that take advantage of the victim's active session, potentially disrupting user management functions.

Impact

Exploitation of this vulnerability could lead to unauthorized actions being performed on behalf of authenticated users, such as deleting accounts or creating new users, thereby disrupting normal user management processes.