Vvveb CVE-2026-34427

Requires low-privileged authenticated access to a Vvveb CMS instance running versions prior to 1.0.8.1. Attacker needs any valid user account credentials-Super Administrator privileges are NOT required as a prerequisite (that is the vulnerability's outcome). The admin user profile save endpoint must be network-accessible to the attacker, which is the default configuration for CMS platforms. Exploitation is EASIER if user registration is enabled (attacker creates own account) versus requiring compromise of existing credentials. The vulnerability exists in default configurations with no special features or settings required. Exploitation is LIMITED by the need for initial authentication (PR:L)-this is not an unauthenticated remote attack. Network access (AV:N) and no user interaction requirement (UI:N) mean exploitation can be fully automated once credentials are obtained. No platform-specific limitations identified; affects all deployment environments (Linux, Windows, Docker) running vulnerable Vvveb versions.

Real-world risk is HIGH for organizations running vulnerable Vvveb instances. CVSS 8.8 (AV:N/AC:L/PR:L/UI:N) accurately reflects the threat: network-accessible exploitation with low complexity requiring only low-privileged authentication and no user interaction. The vulnerability chains privilege escalation with RCE capability, making it particularly dangerous-attackers need only compromised low-privilege credentials (common in CMS environments) to achieve complete system compromise. Attack complexity is genuinely low since parameter injection requires only basic HTTP request manipulation tools. Public commit-level fix details (GitHub commit 0eca14af) provide a blueprint for weaponization, increasing exploitation probability despite no confirmed POC in provided data. EPSS score not available for comparison, and KEV status not confirmed-absence from KEV does not indicate low risk given recent disclosure timeline. SSVC assessment: exploitation is technically straightforward (automatable via script), technical impact is total (RCE as web server user), and it affects a public-facing CMS platform. Mitigation priority should be IMMEDIATE for internet-exposed Vvveb installations, particularly those with user registration enabled. The low privilege requirement (PR:L) means any authenticated account-including trial/demo accounts-becomes an attack vector.

An attacker registers a standard user account on a Vvveb CMS website (or compromises existing low-privilege credentials via phishing). They intercept the profile update request using browser developer tools or a proxy like Burp Suite, then inject the parameter role_id=1 into the POST data submitted to the admin user save endpoint. The application processes this privileged field without validation, escalating the account to Super Administrator. With elevated privileges, the attacker uploads a malicious plugin containing PHP webshell code, which Vvveb extracts and executes on the server. The attacker now has remote code execution capability as the web server user, enabling data exfiltration, backdoor installation, or lateral movement within the hosting environment. Public commit details lower the technical barrier for reproducing this attack.