Is there a public PoC exploit available for CVE-2026-15530?

Yes, a public proof-of-concept exploit is available for CVE-2026-15530. Prioritise patching immediately. EPSS: 0.3%.

WuzhiCMS CVE-2026-15530

Q: What is the CVSS score of CVE-2026-15530?

CVE-2026-15530 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-43276 MEDIUM

Information Exposure (CWE-200)

2026-07-13 VulDB

GHSA-w8p7-vpgq-6p9c

PHP Information Disclosure N A Wuzhicms

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.3 MEDIUM

Network-reachable endpoint requires no authentication or interaction; confidentiality impact is low and scope is unchanged with no integrity or availability effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Jul 13, 2026 - 06:22 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

Analysis Generated

Jul 13, 2026 - 05:55 vuln.today

DescriptionCVE.org

A flaw has been found in WuzhiCMS up to 4.1.0. Affected by this vulnerability is the function config/listimage of the file /index.php?m=attachment&f=index&v=upload of the component Attachment API. Executing a manipulation can lead to information disclosure. The attack can be launched remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Information disclosure in WuzhiCMS up to version 4.1.0 exposes sensitive server-side data through the Attachment API's config/listimage function, reachable at /index.php?m=attachment&f=index&v=upload. Remote unauthenticated attackers can exploit this endpoint without any privileges or user interaction, as confirmed by a publicly available proof-of-concept published via a GitHub issue report. The vendor has not responded to the disclosure, leaving no patch available and all deployments exposed.

Technical ContextAI

WuzhiCMS is a PHP-based content management system (CPE: cpe:2.3:a:n/a:wuzhicms:*:*:*:*:*:*:*:*). The flaw lies in the config/listimage function within the Attachment API component, invoked via the route m=attachment&f=index&v=upload in the application's front controller (index.php). CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) identifies the root cause class: the endpoint fails to enforce proper access controls before returning data, allowing unauthenticated callers to retrieve information about attachment configurations or stored file listings that should be restricted. This is a common PHP CMS pattern where API endpoints are insufficiently gated by authentication middleware.

RemediationAI

No vendor-released patch has been identified at time of analysis - the project was notified via GitHub issue but has not responded. As the primary compensating control, administrators should restrict access to the Attachment API endpoint (/index.php?m=attachment&f=index&v=upload) using web server directives (e.g., nginx deny rules or Apache Require directives) to permit access only from authenticated sessions or trusted IP ranges; note this will break attachment-browsing functionality for unauthenticated users if that is a legitimate use case. Alternatively, deploying a WAF rule to block unauthenticated requests containing m=attachment&f=index&v=upload provides defense without modifying the server configuration. Disabling the Attachment module entirely eliminates the attack surface at the cost of all upload and attachment management capabilities. Administrators should monitor the GitHub repository at https://github.com/wuzhicms/wuzhicms/ and VulDB at https://vuldb.com/vuln/377873 for any community patch or vendor response.