Thelia Page Module: Cross-Site Request Forgery (CVE-2026-120207)

Thelia Page Module versions prior to 2.0.4 contain a cross-site request forgery (CSRF) vulnerability in back-office delete routes. The vulnerability stems from a lack of CSRF tokens and insufficient permission checks, allowing an attacker to craft malicious GET requests that, when visited by a logged-in administrator, result in the deletion of site content. Attackers can leverage this to delete page tags, documents, and TheliaLibrary assets by iterating through sequential IDs.

Impact

Successful exploitation allows for the unauthorized deletion of site images, documents, and page tags across pages, products, and categories. This can result in significant loss of site content and broken site functionality.

Recommendation

1. Upgrade the Thelia Page Module to version 2.0.4 or later immediately.
2. Implement administrative session monitoring to identify anomalous administrative activity following periods of suspected phishing or social engineering.
3. Ensure that administrative access to the Thelia back-office is restricted to trusted networks and protected by robust authentication controls to minimize exposure to CSRF triggers.