The Admidio application up to version 5.0.11 exposes a Cross-Site Request Forgery (CSRF) vulnerability in its plugin management endpoint (modules/plugins.php). This endpoint processes plugin installation, uninstallation, and update commands via GET parameters without validating CSRF tokens. Because modern browsers send SameSite=Lax cookies on top-level GET navigations, an attacker can craft a malicious external page that, when visited by an authenticated administrator, causes the browser to perform unauthorized plugin operations. The uninstall operation is particularly destructive as it executes SQL scripts containing DROP TABLE statements, resulting in permanent data loss. Other administrative functions in Admidio correctly implement CSRF protections, but this endpoint does not. The vulnerability allows an attacker to cause high-impact changes with minimal user interaction.

An attacker can cause an authenticated Admidio administrator to unknowingly perform plugin installation, uninstallation, or update operations by visiting a malicious web page. The uninstall operation executes SQL scripts that drop database tables, leading to irreversible data loss. Installing plugins could introduce vulnerable code, and updates could disrupt plugin functionality. This attack requires only that the administrator visit a crafted page, with no additional interaction. The integrity of the application and its data is severely impacted, but confidentiality and availability impacts are not explicitly described.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The recommended fix is to change plugin management operations from GET to POST requests and add CSRF token validation using SecurityUtils::validateCsrfToken() consistent with other administrative operations. Until a patch is available, administrators should avoid visiting untrusted web pages while authenticated and consider restricting access to the plugin management interface. Monitor vendor channels for official updates or patches.