YesWiki is a wiki system written in PHP. Prior to version 4.6.6, the {{erasespamedcomments}} wiki action (actions/EraseSpamedCommentsAction.php) accepts a suppr[] array from POST and deletes every wiki page whose tag appears in that array, with no authorization check anywhere in the action body or in the page-deletion path it invokes. Combined with YesWiki's allow-by-default action ACL model, any user who has page write access, which is the default for everyone (default_write_acl='*') on a fresh install can permanently delete arbitrary wiki pages, including the front page, admin pages, and pages owned by other users. This issue has been patched in version 4.6.6.

YesWiki, a PHP-based wiki system, contains a critical authorization flaw in versions prior to 4.6.6. The erasespamedcomments wiki action (EraseSpamedCommentsAction.php) accepts a POST array of page tags and deletes corresponding wiki pages without performing any authorization checks. Due to YesWiki's allow-by-default ACL model where all users have write access by default, any authenticated or default user can permanently delete arbitrary wiki pages. This includes critical pages such as the front page, admin pages, and pages owned by other users. The vulnerability requires no special privileges to exploit on a default installation. The flaw has been patched in YesWiki version 4.6.6, with the fix available via a committed patch on GitHub.