The vulnerability is a hard‑coded default password of "admin" stored as a SHA‑512 hash in pheditor.php at line 11. Because no enforcement exists for a password change on first use, any site running an unpatched version exposes an obvious credential to authenticate as an administrator. Upon successful login, an attacker gains unrestricted access to all editor features—including file upload, editing, and the embedded terminal. This permits arbitrary file read/write operations and remote execution of PHP code, effectively compromising the entire application and the underlying system. The issue was resolved in version 2.0.6, which removes the hard‑coded password.

The affected product is Pheditor by pheditor. Versions from 2.0.1 up to, but not including, 2.0.6 contain the hard‑coded password. The issue was patched in 2.0.6; earlier versions remain vulnerable.

With a CVSS score of 9.8 the vulnerability is classified as critical. The EPSS score is < 1%, indicating a very low but non‑zero probability of exploitation. The simplicity of guessing the default password combined with the lack of additional authentication controls makes exploitation highly likely if the web interface is reachable from attacker hosts. The vulnerability is not listed in CISA’s KEV catalog.