An authenticated user can trigger arbitrary code execution through the Blocks module of FuelCMS. The flaw is categorized as CWE-94, indicating a code injection or arbitrary code execution weakness. Exploitation could allow full compromise of the web application and potentially the underlying server, impacting confidentiality, integrity, and availability.

FuelCMS, version 1.5.2, developed by Daylight Studio. No other vendors or product versions were identified in the CVE data.

The vulnerability has a CVSS score of 8.8, indicating high severity. The EPSS score is below 1%, suggesting a low probability of exploitation in the wild, and it is not listed in CISA’s KEV catalog. The likely attack vector requires the attacker to possess valid user credentials to access the Blocks module, after which arbitrary PHP code can be executed.