CVE-2026-127058: WonderCMS before 3.7.0 Unverified Password Change via saveAction
WonderCMS before 3.7.0 contains an unverified password change vulnerability in the saveAction functionality that allows an authenticated attacker to change the administrator password without re-authentication. Attackers can exploit this missing re-verification check during password changes to bypass re-authentication controls and maintain or escalate unauthorized access to the administrative account.
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must already be authenticated and have the high privileges needed to access the password-change functionality. The vulnerability affects the administrator password-change process.
What access does exploitation provide?
An authenticated attacker can change the administrator password without being asked to re-authenticate. This can let them retain or escalate unauthorized access to the administrative account.
Which versions should be remediated?
WonderCMS versions before 3.7.0 are affected. Upgrade to version 3.7.0 or later.