Which versions of Wolf CMS are affected by CVE-2026-67207?

Wolf CMS versions through 0.8.3.1 contain a privilege escalation vulnerability that allows authenticated non-administrative users to bypass authorization controls and perform backup/restore…

Is there a public PoC exploit available for CVE-2026-67207?

Yes, a public proof-of-concept exploit is available for CVE-2026-67207. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate CVE-2026-67207?

Within 24 hours, inventory all Wolf CMS instances and disable or restrict access to BackupRestoreController for non-administrative accounts using reverse proxy or web application firewall rules. Within 7 days, review audit logs for unauthorized backup/restore attempts, enable detailed logging on backup functions, and enforce multi-factor authentication for accounts with administrative backup access. Within 30 days, evaluate migration to an alternative CMS platform or implement application-level access control overrides to verify user roles before backup operations; establish continuous monitoring for abnormal backup/restore activity and conduct a complete audit of backup contents for unauthorized changes.

Wolf CMS CVE-2026-67207

Q: What is the CVSS score of CVE-2026-67207?

CVE-2026-67207 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-51293 HIGH

Incorrect Comparison (CWE-697)

2026-07-30 VulnCheck

GHSA-xv6g-v6rg-vw4p

PHP Authentication Bypass Wolfcms

8.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-reachable controller exploitable by any authenticated non-admin (PR:L, AC:L, no UI); backup create/download/restore yields full confidentiality, integrity, and availability impact within the same app scope.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 20:51 vuln.today

CVE Published

Jul 30, 2026 - 19:30 cve.org

HIGH 8.7

DescriptionCVE.org

Wolf CMS through 0.8.3.1 contains an authorization bypass vulnerability in BackupRestoreController that allows authenticated non-administrative users to access restricted backup functionality due to a PHP operator precedence flaw in the permission check expression. Attackers can exploit the incorrect evaluation of the access control expression to create, download, and restore backups without administrative privileges.

AnalysisAI

Privilege escalation via authorization bypass in Wolf CMS (through 0.8.3.1) lets any authenticated non-administrative user reach the BackupRestoreController and create, download, and restore site backups that should be admin-only. The root cause is a PHP operator-precedence mistake in the permission-check expression, so the access control evaluates incorrectly and grants low-privileged accounts admin-tier backup functionality. Publicly available exploit code exists (published by VulnCheck), but there is no public exploit identified in CISA KEV, so active exploitation is not confirmed.

Technical ContextAI

Wolf CMS is a lightweight PHP-based content management system; the affected component is its BackupRestoreController, which handles creation, download, and restoration of application/database backups. The vulnerability is CWE-697 (Incorrect Comparison / flawed logical evaluation): the permission-gating expression relies on PHP operator precedence, where logical operators (e.g. mixing and/or with &&/|| or omitting parentheses) bind differently than the developer intended, causing the compound boolean condition to short-circuit to a value that admits users who lack the administrator role. Because backup/restore touches the full site content and database, any bypass of that check exposes complete confidentiality and integrity of the deployment. The CPE cpe:2.3:a:wolfcms:wolfcms:*:*:*:*:*:*:*:* indicates all versions are considered affected up to and including 0.8.3.1.

RemediationAI

No vendor-released patch version was identified in the provided data, so no fixed release can be cited with confidence; monitor the VulnCheck advisory (https://www.vulncheck.com/advisories/wolf-cms-authorization-bypass-via-backuprestorecontroller) and the Wolf CMS project for an update, and if a corrected build is published, upgrade to it. As compensating controls, restrict network access to the Wolf CMS administrative and backup routes (the BackupRestoreController endpoints) to trusted admin IPs via reverse-proxy or firewall rules - trade-off: legitimate remote admins must be whitelisted; disable open/self-service user registration and audit existing non-administrative accounts to shrink the pool of accounts able to authenticate - trade-off: adds manual account provisioning overhead; and if BackupRestoreController is not needed, block or remove its route at the web-server layer - trade-off: legitimate admins lose in-app backup/restore and must back up out-of-band. Given the age of the codebase, organizations should also evaluate migrating off Wolf CMS.