Sanluan PublicCMS CVE-2026-8737

Requires PublicCMS deployment with the publiccms-trade module installed and accessible. The TradeAddressListDirective endpoint must be network-reachable (typically deployed on standard HTTP/HTTPS ports). Exploitation succeeds against default configurations of PublicCMS 5.202506.d with no special setup required. Attack surface is limited to PublicCMS instances actually using e-commerce/trade functionality - installations deployed solely for content management without trade features are not exploitable. No authentication, user interaction, or privileged access required per CVSS vector (AV:N/AC:L/PR:N/UI:N). Trade address data must exist in the database for information disclosure to occur.

Real-world risk is moderate despite the CVSS 5.5 score. CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms network-accessible exploitation requiring no privileges or user interaction, with E:P indicating proof-of-concept code exists publicly. However, impact is limited to confidentiality breach of low severity (VC:L) with no integrity or availability impact, and no cross-scope effects. The publicly available exploit on vulnplus-note.wetolink.com increases exploitation probability for opportunistic attackers targeting PublicCMS e-commerce installations. Not present in CISA KEV suggests no confirmed widespread or targeted exploitation campaigns. EPSS score unavailable limits automated risk quantification. Primary concern is privacy exposure for e-commerce sites using PublicCMS trade functionality - attackers can enumerate customer addresses without authentication, creating GDPR/privacy compliance risk. Vendor non-responsiveness (per disclosure timeline) suggests no official patch forthcoming, elevating risk for existing deployments. This is a genuine privacy risk for affected installations but not a critical infrastructure threat.

Remote attacker accesses the PublicCMS trade module without authentication and submits HTTP requests to the TradeAddressListDirective endpoint, manipulating userId and id parameters to iterate through sequential customer IDs. By enumerating these values, the attacker retrieves complete trade address records containing customer names, shipping addresses, and contact phone numbers for all users in the e-commerce database. Public exploit code at vulnplus-note.wetolink.com provides ready-made attack automation.