WBCE CMS versions 1.6.3 and earlier allow an authenticated attacker with administrative privileges to upload a specially crafted ZIP module that contains embedded PHP reverse‑shell code. When the malicious module is installed, the system executes the PHP code on the server, granting the attacker remote control over the affected host. The vulnerability enables full compromise of confidentiality, integrity, and availability, effectively turning the CMS into a command and control point for further attacks. The weakness is identified as CWE‑434, Unrestricted Upload of File with Dangerous Type.

The affected product is WBCE CMS. Versions through 1.6.3 are vulnerable. The Common Platform Enumeration for 1.6.5 is present in the data set, suggesting that the fix is included in version 1.6.5 and later. Administrators running any earlier release must be aware that they are exposed.

The CVSS score of 8.6 indicates a high severity, and the EPSS score of 1% shows that the vulnerability is not widely exploited but still represents a realistic threat. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires authenticated access; the attacker must obtain or compromise an administrator account to upload and activate the malicious module. Once activated, the attack runs with the privileges of the web server, providing a full remote execution vector.