CVE-2026-127058 · Runtime
NO FIX YET · SEE WHAT TO DO
WonderCMS before 3.7.0 lets a logged-in user change the administrator password through the saveAction function without re-entering the current password. An attacker who holds any authenticated session can use this to lock the real admin out and keep access to the admin account.
first public Nov 1, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Sites running WonderCMS before 3.7.0 that have any account able to log in to the admin area are exposed, since the attack starts from an authenticated session. Sites on 3.7.0 or later, or with no login accounts beyond a trusted admin, are less exposed. The sources do not say whether the flaw is reachable by default configuration.
Not affected if wondercms-3.7.0-or-later
Who cares php, self-hosted, wondercms
3.7.0 are listed as affected.3.7.0 or laterWonderCMS before 3.7.0 contains an unverified password change vulnerability in the saveAction functionality that allows an authenticated attacker to change the administrator password without re-authentication. Attackers can exploit this missing re-verification check during password changes to bypass re-authentication controls and maintain or escalate unauthorized access to the administrative account.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.