CVE-2014-0010: Multiple cross-site request forgery (CSRF) vulnerabilities in user/profile/index.php in Moodle through 2.2....

Security readout for executives and security teams

This CVE affects older Moodle sites. A malicious site could abuse a logged-in administrator’s browser to delete user profile categories or fields without the administrator intending it. The issue is operationally disruptive rather than clearly system-compromising in the provided sources. Exposure is likely limited to organizations still running the affected legacy Moodle branches, especially internet-facing learning portals where administrators manage profile fields and may browse while authenticated. Prioritize remediation for any remaining legacy Moodle deployment. The issue can disrupt identity/profile data management, but the provided evidence does not indicate active exploitation or full platform compromise. Mitigation focus: Inventory Moodle instances and confirm exact branch and patch level.; Upgrade affected Moodle branches to vendor-corrected or currently supported releases.; Check Moodle and distribution advisories for package-specific update guidance..

Prepared

Jun 14, 2026, 14:50 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.