Movable Type CVE-2026-103668

The vulnerable code path is the Site Search feature of Movable Type; exploitation requires that an affected instance exposes this search functionality to the attacker (the default blog/site search available to site visitors), reachable over the network. Per CVSS AV:N/AC:L/PR:N/UI:N, no authentication, no user interaction, and no special non-default configuration are indicated - exploitation targets the standard search function of an affected Movable Type / Movable Type Premium / Cloud Edition deployment. The primary limiting factor is reachability: sites that do not expose Site Search publicly, or that front it with a WAF/filtering proxy, reduce exposure. Exact affected version boundaries should be confirmed against the JVN/vendor advisory before scoping.

This is a genuine high-priority vulnerability. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated flaw requiring no user interaction, and the description confirms an unauthenticated SQL injection in the Site Search function - these signals are mutually consistent rather than conflicting. Vulnerable-system impact is weighted toward confidentiality (VC:H) with limited integrity/availability (VI:L/VA:L), matching classic read-oriented SQLi against the backing database. The CVSS base score of 8.8 (4.0) reflects this. However, several key risk-prioritization signals are MISSING from the input: there is no EPSS exploitation-probability score, no CISA KEV listing, and no POC/exploit-code indicator provided - so no public exploit identified at time of analysis, and active exploitation cannot be asserted. Net: treat as a real, patch-now priority because of the unauthenticated-network-SQLi profile and CWE-89 class, but current evidence points to no confirmed in-the-wild activity; prioritization is driven by exploitability characteristics, not by observed exploitation.

A remote, unauthenticated attacker sends a crafted request to the Site Search endpoint of an internet-facing Movable Type (or Movable Type Premium / Cloud Edition) site, injecting SQL through an insufficiently sanitized search parameter. The injected query is executed against the backend database, letting the attacker read sensitive data such as user credentials and content (VC:H). No public exploit code is identified in the provided data, but the low attack complexity and lack of authentication make exploitation straightforward to develop.