CVE-2026-78834: CmSimple CMSimple vulnerability
A code execution vulnerability exists in CMSimple 5.22 in the CoAuthors plugin. An authenticated low-privileged user who can modify page content and provide controlled imported content can trigger server-side execution by referencing crafted external or uploaded text content through the affected content import feature.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker must be an authenticated low-privileged user with permission to modify page content. They also need to be able to supply controlled imported content to the affected CoAuthors content import feature.
Is CMSimple affected by default?
The available information identifies the CoAuthors plugin's content import feature as the affected component. It does not state whether that plugin or feature is enabled in a default installation.
What conditions are required to trigger code execution?
The attacker must reference crafted external or uploaded text content through the affected import feature after obtaining the required authenticated content-editing access.
How can administrators reduce exposure if they cannot patch immediately?
Restrict low-privileged users' ability to modify page content and prevent them from supplying or referencing untrusted external or uploaded text through the CoAuthors import feature. The provided information does not identify a vendor workaround.