CVE-2026-88418: CSRF
CMSimple 5.24 ships with CSRF protection disabled by default, which turns csrfProtection() into a no-op on every state-changing admin request, and it does not send the csrftoken hidden field in admin forms. Because administrator authentication is cookie-only and no CSRF token is enforced, an unauthenticated attacker can induce a logged-in administrator's browser to issue a forged content-save request with a text payload containing a scripting marker. The marker is stored verbatim into content/content.php; on every subsequent page view evaluatecmsimplescripting() (functions.php) executes the marker body with PHP eval() — for all visitors, including unauthenticated ones. This yields persistent remote code execution on the web server.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Sites are exposed when an administrator is logged in and can be induced to visit attacker-controlled content. After the forged save succeeds, the injected scripting marker runs on subsequent page views for all visitors, including unauthenticated users.
What does an attacker need to exploit this issue?
The attacker does not need to authenticate to the CMS. They need a logged-in administrator's browser to send a forged state-changing content-save request containing a scripting marker.
Are default installations affected?
Yes. CMSimple 5.24 ships with CSRF protection disabled by default, so csrfProtection() does not enforce a token and admin forms do not include the csrf_token hidden field.
How can I determine whether exploitation may have occurred?
Inspect content/content.php for unexpected scripting markers or content that was not intentionally added by an administrator. Such markers are stored verbatim and are evaluated through evaluate_cmsimple_scripting() when pages are viewed.