The vulnerability in YesWiki before version 4.6.7 is a CSRF issue in the ajaxdeletepage handler. It does not validate a CSRF token on GET requests containing a jsonp_callback parameter, enabling attackers to cause permanent deletion of pages by luring authenticated users to malicious links. This results in loss of page content and related metadata such as ACLs, links, triples, comments, and referrers.

Successful exploitation leads to permanent deletion of arbitrary pages and their associated data by authenticated users without their consent. This compromises data integrity and availability within the YesWiki platform. The vulnerability has a high severity score (CVSS 8.1) due to the ease of exploitation (network attack vector, low attack complexity, no privileges required) and significant impact on integrity and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should upgrade to YesWiki version 4.6.7 or later once available. Until then, administrators should consider restricting access to the ajaxdeletepage handler or implementing additional CSRF protections such as validating tokens on all state-changing requests. Avoid clicking on untrusted links while logged in as an administrator or page owner.