Description
A weakness has been identified in WMCMS 4.446.1257. The affected element is an unknown function of the file /index.php. This manipulation of the argument path/file causes information disclosure. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.
Published: 2026-10-12
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: Information Disclosure
Action: Assess Impact
AI Analysis

Impact

A vulnerability in WMCMS 4.446.1257 allows remote attackers to target the index.php file. By manipulating the path/file argument an attacker can read arbitrary files on the server, revealing sensitive configuration or data. The weakness involves improper access control and inadequate input validation, as identified by CWE-200 and CWE-284, and results in information disclosure to remote parties.

Affected Systems

The affected product is WMCMS version 4.446.1257. No other version ranges are specified; the vulnerability is tied to this specific build and appears to affect the default installation where index.php handles file path parameters without proper checks.

Risk and Exploitability

The CVSS score of 5.3 classifies the vulnerability as moderate severity. EPSS data is not available, and the issue is not listed in the CISA KEV catalog, suggesting that at the time of scoring it was not observed in the wild. However, public exploits have been posted, indicating that the attack vector is remote and can be executed by anyone with network access to the affected instance.

Generated by OpenCVE AI on October 12, 2026 at 08:21 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply an up‑to‑date release of WMCMS that contains the fix for index.php file path handling, if available.
  • Modify the web server configuration to deny direct access to /index.php or restrict the path/file parameter to a whitelist of allowed directories.
  • Adjust file system permissions on the web root so that the web server user cannot read sensitive files outside the intended content area.
  • If an immediate patch is not available, monitor incoming requests for anomalous path/file values and block suspicious traffic via a web application firewall.

Generated by OpenCVE AI on October 12, 2026 at 08:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 12 Oct 2026 07:30:00 +0000

Type Values Removed Values Added
Description A weakness has been identified in WMCMS 4.446.1257. The affected element is an unknown function of the file /index.php. This manipulation of the argument path/file causes information disclosure. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.
Title WMCMS index.php information disclosure
First Time appeared Wmcms
Wmcms wmcms
Weaknesses CWE-200
CWE-284
CPEs cpe:2.3:a:wmcms:wmcms:*:*:*:*:*:*:*:*
Vendors & Products Wmcms
Wmcms wmcms
References
Metrics cvssV2_0

{'score': 4, 'vector': 'AV:N/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 4.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Wmcms Wmcms
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-12T07:15:18.816Z

Reserved: 2026-10-11T10:12:10.993Z

Link: CVE-2026-108811

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-12T08:17:19.020

Modified: 2026-10-12T08:17:19.020

Link: CVE-2026-108811

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-12T08:30:07Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor

  • CWE-284

    Improper Access Control