CVE-2025-15455 is an authentication bypass vulnerability affecting the bg5sbk MiniCMS product, specifically versions 1.0 through 1.8. The vulnerability resides in the delete_page function within the /minicms/mc-admin/page.php file, part of the File Recovery Request Handler component. Due to improper authentication checks, remote attackers can invoke this function without any credentials, allowing them to delete pages arbitrarily. This flaw does not require any privileges, user interaction, or prior authentication, making it remotely exploitable over the network with low complexity. The vulnerability impacts the integrity and availability of the CMS content by enabling unauthorized deletion of pages, potentially disrupting website operations or causing data loss. Although an exploit has been published publicly, there are no confirmed reports of active exploitation in the wild. The vendor was notified early but has not issued any patches or advisories, leaving users exposed. The CVSS 4.0 vector (AV:N/AC:L/AT:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P) indicates network attack vector, low attack complexity, no authentication or user interaction required, and partial impact on integrity and availability. This vulnerability is critical for organizations relying on MiniCMS for content management, especially those with public-facing websites where unauthorized page deletion could cause reputational damage or operational disruption.

For European organizations, this vulnerability could lead to unauthorized deletion of web content managed by MiniCMS, resulting in website defacement, loss of critical information, or service disruption. This can affect business continuity, customer trust, and regulatory compliance, especially for sectors requiring data integrity such as finance, healthcare, and government. The lack of authentication requirement means attackers can exploit the vulnerability remotely without insider access, increasing the attack surface. If exploited, attackers could also use the deletion capability as a foothold for further attacks or to cover tracks by removing audit trails. The absence of vendor response and patches increases the risk exposure duration. Organizations using MiniCMS in critical infrastructure or public services may face reputational damage and operational downtime. Additionally, the exploit's public availability raises the likelihood of opportunistic attacks targeting vulnerable European entities.

Given the lack of official patches, European organizations should implement immediate compensating controls. These include restricting network access to the MiniCMS admin interface via firewalls or VPNs to trusted IP addresses only. Employ web application firewalls (WAFs) with custom rules to detect and block suspicious requests targeting the delete_page function or related endpoints. Regularly back up CMS content and implement integrity monitoring to quickly detect unauthorized deletions. Consider isolating MiniCMS instances from critical networks and applying strict access controls. If feasible, migrate to alternative CMS platforms with active security support. Monitor threat intelligence feeds for any new exploit variants or vendor patches. Conduct internal penetration testing to verify the vulnerability and effectiveness of mitigations. Finally, maintain detailed logs and prepare incident response plans to respond rapidly if exploitation is detected.