CVE-2026-126323

Name of the Vulnerable Software and Affected Versions Vvveb versions prior to 1.0.8.7

Description A cross-site request forgery issue exists where the checkCsrf() function in admin/controller/base.php only validates tokens for POST requests. This allows attackers to trick an authenticated administrator into executing forged GET requests to perform state-changing actions, such as deleting user accounts, sites, orders, and menus, or modifying comment statuses.

Recommendations Update to version 1.0.8.7 or later. As a temporary mitigation, restrict access to the admin/controller/base.php file to trusted IP addresses.