EUVD-2026-74265
GHSA-x6hj-fj57-58jm
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable CMS, low complexity once authenticated; PR:L because a valid low-privilege account is required; full C/I/A impact from code execution.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
4DescriptionCVE.org
A code execution vulnerability exists in CMSimple 5.22 in the CoAuthors plugin. An authenticated low-privileged user who can modify page content and provide controlled imported content can trigger server-side execution by referencing crafted external or uploaded text content through the affected content import feature.
AnalysisAI
Server-side code execution in CMSimple 5.22's CoAuthors plugin enables an authenticated low-privileged user who can edit page content to achieve full remote code execution by passing crafted external or uploaded text through the plugin's content import feature. The vulnerability is rooted in CWE-94 (improper code generation control), where imported content is processed server-side without sufficient sanitization, allowing arbitrary PHP or server-side logic to execute in the web server context. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated session with low-privilege page-editing rights within CMSimple 5.22. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects meaningful but not catastrophic risk: the network-accessible attack path and low complexity are offset by the requirement for low-privilege authentication. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch has been identified at the time of analysis; affected version information is limited to CMSimple 5.22 with the CoAuthors plugin and no fixed release has been published to the references. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit and restrict who has content editing and import permissions in the CoAuthors plugin; disable the plugin entirely if not actively required for daily operations. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today