SeaCMS CVE-2026-85138

The WeChat Module must be installed and its endpoint (weixin/index.php) must be publicly reachable over HTTP/HTTPS. Exploitation requires the ability to send HTTP POST requests with attacker-controlled Content values in WeChat-formatted XML; no authentication is required (CVSS PR:N, UI:N). SeaCMS deployments that do not use WeChat integration and have this file absent or access-restricted (e.g., via web server deny rules) are not exposed. Exploitation is bounded by the query context of the WeChat handler; full database access depends on the database user privileges assigned to the CMS application.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) marks this as remotely exploitable with no authentication and no special conditions, which is a significant exposure posture. However, the impact metrics (VC:L/VI:L/VA:L) reflect limited scope - the injected query operates within the WeChat handler's query context, not necessarily with blanket database-admin access. The 5.5 base score is moderate, but the presence of a public PoC (E:P in the supplemental vector, confirmed via the GitHub advisory) substantially lowers the exploitation barrier and should push defenders to treat this with greater urgency than the raw score implies. No CISA KEV listing is present and EPSS data was not supplied, so widespread active exploitation is not confirmed. The WeChat module must be enabled and the endpoint publicly reachable for exploitation; sites that do not use WeChat integration are unexposed. The absence of a confirmed vendor patch compounds residual risk for sites that do run this component.

An attacker identifies a publicly accessible SeaCMS 13.6 instance with the WeChat module active and sends a crafted HTTP POST to weixin/index.php containing SQL metacharacters in the Content XML field. The addslashes() call fails to neutralize the payload, and the injected SQL executes within the database query, potentially exfiltrating administrator credentials or session data. A public proof-of-concept detailing this technique is available on GitHub, meaning exploitation requires only basic SQL injection knowledge and knowledge of the endpoint path.