Information disclosure in WMCMS index.php
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Information disclosure, Security bypass
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-200 and CWE-284.
Summary
WMCMS 4.446.1257 contains an information disclosure flaw in an unknown function of /index.php. A manipulated path/file argument exposes sensitive information to an unauthorized actor (CWE-200). A remote attacker with low privileges can exploit this without user interaction. A public exploit has been made available and is linked in the references.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
A weakness has been identified in WMCMS 4.446.1257. The affected element is an unknown function of the file /index.php. This manipulation of the argument path/file causes information disclosure. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | WMCMS | 4.446.1257 | — | No fix listed | CNA |
- WMCMS Vendor— Affected 4.446.1257 Fixed in — No fix listed CNA
CPE names CNA · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:wmcms:wmcms:*:*:*:*:*:*:*:* | — | — | — |
- cpe:2.3:a:wmcms:wmcms:*:*:*:*:*:*:*:* Versions — — ·—
Remediation
The sources list no fixed version for WMCMS.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Timeline
- 2026-10-12 Threatist record created from CVE-2026-108811
- 2026-10-12 Alias added: GHSA-rm82-qc74-7g6j
- 2026-10-13 CISA SSVC decision points changed
- 2026-10-13 Priority changed: LOW → MEDIUM
References
Sources
- CVE-2026-108811 · CVE Program
- CVE-2026-108811 · NVD
- FIRST EPSS
- GHSA-rm82-qc74-7g6j · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences