CVE-2025-15455 Details

A vulnerability allowing unauthorized page deletion has been identified in bg5sbk MiniCMS versions through 1.8. The issue resides in the File Recovery Request Handler, specifically within the delete_page function of the /minicms/mc-admin/page.php file. This vulnerability stems from a lack of proper authentication checks, enabling remote attackers to delete published pages without any authentication. Exploitation involves sending a deletion request with a crafted mc_token Cookie, bypassing authentication requirements.

It is recommended to upgrade to the latest stable version of MiniCMS, as the current version 1.8 is vulnerable. Additionally, implement permission verification checks before allowing page deletions, validate the mc_token Cookie, and consider changing the request method to POST with CSRF token verification to prevent unauthorized deletion requests.