Removing user comments in Forum

There is another CSRF in forum. User comment box does not have a verified CSRF token either. So if we have similar payload as the plugin CSRF one:

Then once the user who created the comment visits the link their comments get deleted. This is because comment deletion is sent through GET request. 

This severity is tasked high because of this: 

In the Forum page, user has permission to add image through url. Now the attacker can put this as the url :

http://[oxwall_url]/lab1/forum/deletePost/1/[victim’s comment id]

Once that is posted to the Forum page, Victim’s comment id X gets removed right way because the server calls the link as a GET request.