PublicCMS CVE-2026-8738

Requires the PublicCMS trade module (publiccms-trade) to be installed and actively processing payments - base PublicCMS installations without e-commerce features are not vulnerable. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no special conditions - remote unauthenticated exploitation against default trade module configurations. Attack requires network access to the trade payment controller endpoints, but no authentication, specific user interaction, or non-default configuration settings. The business logic flaw is inherent to the payment workflow code, not dependent on optional features. Limiting factor: exploitation impact is constrained to payment manipulation (VI:L/VA:L) rather than full system compromise, and requires the target site to be running the vulnerable version 5.202506.d specifically.

Real-world risk is MODERATE with caveats. The CVSS 4.0 score of 5.5 reflects low impact to integrity and availability (VI:L/VA:L) with no confidentiality impact, but the attack vector is fully remote with no authentication required (AV:N/AC:L/PR:N/UI:N). The exploit maturity level E:P (Proof-of-concept) confirms publicly available attack code exists. However, exploitation requires the PublicCMS trade module to be deployed and actively processing payments - not all PublicCMS installations include e-commerce functionality. The vendor's non-response to disclosure raises concern about patch availability. SSVC decision factors: exploitation is public (exploit POC available), technical impact is partial (payment manipulation but not arbitrary code execution), and automatable (AV:N/AC:L suggests scriptable exploitation). Priority depends on whether your PublicCMS deployment uses the trade module - if trade features are enabled, this is HIGH priority due to payment fraud risk and public exploit; if trade module is unused or not installed, risk is NEGLIGIBLE. Missing signals: EPSS score not provided, not in CISA KEV (suggesting no widespread exploitation yet), exact attack mechanism not detailed in available references.

An unauthenticated attacker identifies a PublicCMS e-commerce site running version 5.202506.d. Using the publicly available exploit code from https://vulnplus-note.wetolink.com/share/ayeMf4xWK0ZZ, the attacker crafts HTTP requests directly to the vulnerable TradeOrderController.pay or TradePaymentController.pay endpoints, manipulating payment workflow parameters to bypass payment verification, alter transaction amounts, or mark unpaid orders as completed. This could enable purchasing products without payment, obtaining services fraudulently, or disrupting legitimate payment processing.