WMCMS CVE-2026-108811

Exploitation requires an authenticated session with at least low-level privileges (PR:L) on the WMCMS 4.446.1257 web application; the attacker then supplies a malicious value in the path/file argument of /index.php to traverse to and read unintended files. Limiting factors: the attacker must first obtain valid low-privileged credentials (no unauthenticated access per the CVSS vector), and impact is confined to information disclosure - no write, code-execution, or availability effect. The flaw is reachable over the network against a standard deployment with no special non-default configuration indicated in the description.

This is a moderate-risk, low-priority issue in practice. The CVSS 4.0 base vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a remotely reachable, low-complexity attack requiring low-level authentication (PR:L) with limited confidentiality impact (VC:L) and no integrity or availability impact. The exploit maturity is marked E:P (proof-of-concept), consistent with the publicly available exploit code on GitHub, so publicly available exploit code exists but there is no public exploit confirmed as weaponized. No CISA KEV listing and no EPSS score were provided in the input, so there is no signal of active or widespread exploitation - absence of these should not be read as either high or low exploitation likelihood, only as missing data. A notable conflict: the vendor/VulDB rated confidentiality as Low (VC:L), yet the public exploit and its GitHub title describe an *arbitrary file read* primitive, which typically enables reading sensitive files (configuration, credentials) and would justify a High confidentiality rating - verify the true read scope against the PoC before finalizing severity. The authentication requirement (PR:L) is the main factor limiting real-world risk: an attacker needs at least a low-privileged account, making this less attractive than an unauthenticated flaw. Net assessment: a genuine but second-tier vulnerability, not an emergency, absent any KEV/EPSS evidence of in-the-wild use.

An attacker who holds a low-privileged account on a WMCMS 4.446.1257 instance sends a crafted HTTP request to /index.php, manipulating the path/file argument to point at files outside the intended scope. Because public proof-of-concept exploit code is available on GitHub, the attacker can read server-side files such as configuration or source containing secrets, enabling further disclosure. Low attack complexity and network reachability make the request trivial to replay once authenticated.