October EUVD-2026-22704

While the CVSS score of 4.9 appears moderate, the actual real-world risk is elevated by several factors. The vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N indicates network-accessible exploitation with low attack complexity and no user interaction required, but requires high privileges (Editor role). The confidentiality impact is rated High, reflecting direct exposure of secrets like database passwords and API keys. EPSS score is not provided, but the publicly documented nature and straightforward exploitation method (simple text injection) suggest automatable exploitation probability is high. The vulnerability does not appear in CISA KEV status at analysis time, and no public proof-of-concept exploit code is independently confirmed in the provided data, though the attack is trivial to replicate once Editor access is obtained. Real-world risk depends heavily on organizational controls: sites that restrict Editor access to fully trusted administrators significantly reduce impact, while sites that grant Editor access broadly to content teams face substantial risk of credential exfiltration. The fact that cms.safe_mode must be enabled limits blast radius compared to a pre-authentication vulnerability, but many productions enable this mode precisely because they want to allow safe content editing without PHP execution, making this a relevant threat vector.

A compromised or malicious Editor-level account (such as a disgruntled content contributor with edit permissions) opens a page in the CMS, navigates to settings fields, and injects the text ${DB_PASSWORD} into a field like page description or metadata. Upon saving, the CMS parses this field through parse_ini_string(), which resolves ${DB_PASSWORD} to the actual database password from the server's environment variables. When the attacker reopens the same page or views the rendered output, the resolved password is displayed, allowing credential theft. If the environment also exports AWS_ACCESS_KEY_ID or APP_KEY, those are similarly exfiltrated.