{"id":"CVE-2026-127058","kind":"vulnerability","aliases":["CVE-2026-127058"],"related":[],"title":"WonderCMS: saveAction lets an attacker change the admin password without re-authentication","description":"WonderCMS before 3.7.0 contains an unverified password change vulnerability in the saveAction functionality that allows an authenticated attacker to change the administrator password without re-authentication. Attackers can exploit this missing re-verification check during password changes to bypass re-authentication controls and maintain or escalate unauthorized access to the administrative account.","summary":"WonderCMS before 3.7.0 lets a logged-in user change the administrator password through the saveAction function without re-entering the current password. An attacker who holds any authenticated session can use this to lock the real admin out and keep access to the admin account.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["php","runtime","self-hosted","wondercms"],"not_affected_if":["wondercms-3.7.0-or-later"],"how_to_check":"- Check the installed WonderCMS version in the site's installation files; versions below `3.7.0` are listed as affected.","fix":"- WonderCMS: upgrade to `3.7.0` or later","status":"open","published_at":"2026-11-12T14:17:29+00:00","first_seen_at":"2026-11-12T14:38:37+00:00","triaged_at":"2026-11-12T14:39:08+00:00","updated_at":"2026-11-12T14:39:08+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-12T14:39:08Z","model":"claude-haiku-5-5","output":{"fix":"- WonderCMS: upgrade to `3.7.0` or later","reach":"internet","title":"WonderCMS: saveAction lets an attacker change the admin password without re-authentication","impact":"high","summary":"WonderCMS before 3.7.0 lets a logged-in user change the administrator password through the saveAction function without re-entering the current password. An attacker who holds any authenticated session can use this to lock the real admin out and keep access to the admin account.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["wondercms","self-hosted","php"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker takes over the administrator account and keeps access","analyst_note":"","how_to_check":"- Check the installed WonderCMS version in the site's installation files; versions below `3.7.0` are listed as affected.\n- unknown","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["wondercms-3.7.0-or-later"],"who_is_affected":"Sites running WonderCMS before 3.7.0 that have any account able to log in to the admin area are exposed, since the attack starts from an authenticated session. Sites on 3.7.0 or later, or with no login accounts beyond a trusted admin, are less exposed. The sources do not say whether the flaw is reachable by default configuration.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000716,"input_tokens":4606,"output_tokens":510,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-127058':16A,19A '-2026':15A,18A '3.7.0':28B,75C 'access':68B,123C 'account':72B,127C 'admin':8A,64B,71B 'administr':37B,94C,126C 'allow':87C 'attack':5A,51B,90C,100C 'authent':13A,55B,89C,99C,116C 'bypass':113C 'chang':6A,35B,80C,92C,111C 'check':108C 'contain':76C 'control':117C 'current':48B 'cve':14A,17A 'enter':46B 'escal':121C 'exploit':102C 'function':42B,85C 'hold':53B 'host':24B 'keep':67B 'let':3A,29B 'lock':61B 'log':32B 'logged-in':31B 'maintain':119C 'miss':104C 'password':9A,38B,49B,79C,95C,110C 'php':20B 're':12A,45B,98C,106C,115C 're-authent':11A,97C,114C 're-ent':44B 're-verif':105C 'real':63B 'runtim':21B 'saveact':2A,41B,84C 'self':23B 'self-host':22B 'session':56B 'unauthor':122C 'unverifi':78C 'use':58B 'user':34B 'verif':107C 'vulner':81C 'without':10A,43B,96C 'wondercm':1A,25B,26B,73C","nicknames":[],"mitigations":[],"who_affected":"Sites running WonderCMS before 3.7.0 that have any account able to log in to the admin area are exposed, since the attack starts from an authenticated session. Sites on 3.7.0 or later, or with no login accounts beyond a trusted admin, are less exposed. The sources do not say whether the flaw is reachable by default configuration.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","php","runtime","selfhosted","wondercms"],"campaign_type":null,"search_a":"'-127058':16A,19A '-2026':15A,18A 'admin':8A 'attack':5A 'authent':13A 'chang':6A 'cve':14A,17A 'let':3A 'password':9A 're':12A 're-authent':11A 'saveact':2A 'without':10A 'wondercm':1A","search_b":"'3.7.0':28B 'access':68B 'account':72B 'admin':64B,71B 'administr':37B 'attack':51B 'authent':55B 'chang':35B 'current':48B 'enter':46B 'function':42B 'hold':53B 'host':24B 'keep':67B 'let':29B 'lock':61B 'log':32B 'logged-in':31B 'password':38B,49B 'php':20B 're':45B 're-ent':44B 'real':63B 'runtim':21B 'saveact':41B 'self':23B 'self-host':22B 'session':56B 'use':58B 'user':34B 'without':43B 'wondercm':25B,26B","search_c":"'3.7.0':75C 'access':123C 'account':127C 'administr':94C,126C 'allow':87C 'attack':90C,100C 'authent':89C,99C,116C 'bypass':113C 'chang':80C,92C,111C 'check':108C 'contain':76C 'control':117C 'escal':121C 'exploit':102C 'function':85C 'maintain':119C 'miss':104C 'password':79C,95C,110C 're':98C,106C,115C 're-authent':97C,114C 're-verif':105C 'saveact':84C 'unauthor':122C 'unverifi':78C 'verif':107C 'vulner':81C 'without':96C 'wondercm':73C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-01T19:25:57+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-127058","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-127058","severity":null,"published_at":"2026-11-12T14:17:29+00:00","modified_at":"2026-11-12T14:17:29+00:00","first_seen_at":"2026-11-12T14:38:37+00:00","fetched_at":"2026-11-12T14:38:37+00:00","note":null}],"documents":[{"id":135521,"url":"https://github.com/WonderCMS/wondercms/security/advisories/GHSA-qc3r-v7fc-24xc","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-01T19:25:57+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":135522,"url":"https://www.vulncheck.com/advisories/wondercms-before-unverified-password-change-via-saveaction","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}