Is there a public PoC exploit available for CVE-2026-8747?

Yes, a public proof-of-concept exploit is available for CVE-2026-8747. Prioritise patching immediately. EPSS: 0.0%.

Z-BlogPHP CVE-2026-8747

Q: What is the CVSS score of CVE-2026-8747?

CVE-2026-8747 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-30696 LOW

Improper Authorization (CWE-285)

2026-05-17 VulDB

GHSA-g9j8-fr6x-695w

Authentication Bypass PHP

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

May 17, 2026 - 11:22 NVD

MEDIUM LOW

CVSS changed

May 17, 2026 - 11:22 NVD

6.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

May 17, 2026 - 11:01 vuln.today

DescriptionCVE.org

A weakness has been identified in Z-BlogPHP 1.7.4.3430. This affects the function CheckComment of the file zb_system/function/c_system_event.php of the component Commend Approval Handler. This manipulation causes improper authorization. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks.

AnalysisAI

Improper authorization in Z-BlogPHP 1.7.4.3430 allows authenticated attackers to bypass comment approval controls via the CheckComment function in c_system_event.php. Remote exploitation requires low-complexity attacks with low-privilege credentials and no user interaction (CVSS AV:N/AC:L/PR:L/UI:N). Public exploit code is available (VulDB 364334), enabling attackers to read, modify, or disrupt comment moderation workflows with low confidentiality, integrity, and availability impact. No vendor patch information identified at time of analysis; EPSS and KEV data not provided.

Technical ContextAI

Z-BlogPHP is a PHP-based content management system and blogging platform. The vulnerability resides in the CheckComment function within zb_system/function/c_system_event.php, part of the comment approval handler responsible for moderating user-submitted comments. The flaw stems from CWE-285 (Improper Authorization), indicating that the application fails to correctly enforce access controls on privileged operations. This allows authenticated users with low-privilege accounts to perform actions that should require elevated permissions, such as approving or manipulating comments without proper authorization checks. The network-accessible attack vector (AV:N) combined with low attack complexity (AC:L) suggests the vulnerable endpoint is exposed via web interfaces without requiring complex preconditions.

RemediationAI

No vendor-released patch or fixed version is identified in the provided references (CVSS RL:X indicates workaround/hotfix status unavailable at time of disclosure). Administrators should monitor the official Z-BlogPHP GitHub repository at github.com/zblogcn/zblogphp and project website for security updates addressing CVE-2026-8747. As interim compensating controls: restrict comment submission to trusted user roles only by modifying user permission settings in the Z-BlogPHP admin panel (this reduces the pool of potential attackers but impairs community engagement features); implement web application firewall (WAF) rules to detect anomalous requests to c_system_event.php targeting the CheckComment function (requires custom rule development based on exploit traffic patterns documented at vulnplus-note.wetolink.com); audit all user accounts with low-privilege credentials and revoke access for untrusted or inactive users to minimize insider threat exposure. Note that restricting comment features may conflict with blog functionality requirements-coordinate with content managers before deployment. Consult VulDB CTI data at vuldb.com/vuln/364334/cti for additional threat intelligence.