Is CVE-2026-120207 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-120207 being exploited in the wild.

How severe is CVE-2026-120207?

High severity, with a CVSS score of 7.1, published 31 October 2026.

Which products and versions are affected?

Thelia Page Module before 2.0.4.

How is CVE-2026-120207 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-120207?

Check whether you run Thelia Page Module at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-120207: Thelia Page Module CSRF in image deletion

CVE-2026-120207 · Severity: high · CVSS 7.1 · Published 2026-10-31

Thelia Page Module is a content management plugin that manages page images, documents, and tags in a Thelia e-commerce system. A cross-site request forgery (CSRF) vulnerability in versions before 2.0.4 allows attackers to trick logged-in administrators into deleting page images, documents, and associated media by simply visiting a malicious link, potentially resulting in data loss and site defacement.

Vendors: Thelia.

Quick answers

Is CVE-2026-120207 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-120207 being exploited in the wild.
How severe is CVE-2026-120207?: High severity, with a CVSS score of 7.1, published 31 October 2026.
Which products and versions are affected?: Thelia Page Module before 2.0.4.
Is there a fix for CVE-2026-120207?: Yes: fixed in 2.0.4. Until then: Restrict access to the admin panel to trusted networks or IP addresses and ensure administrators do not navigate to untrusted links while logged into the back office. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-120207 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-120207?: Check whether you run Thelia Page Module at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 2.0.4

Restrict access to the admin panel to trusted networks or IP addresses and ensure administrators do not navigate to untrusted links while logged into the back office.

Technical details

The vulnerability exists in the PageImageController deleteImageAction method, which accepts GET requests to delete images without requiring CSRF tokens or verifying permission scope. An attacker can craft GET requests that walk through sequential image IDs to delete multiple assets across pages, products, and categories without the administrator's knowledge. The fix in version 2.0.4 enforces tokenized POST requests and permission checks on all admin write operations.

Affected products

Thelia Page Module before 2.0.4

Timeline

2026-10-31: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.