The vulnerability allows an authenticated administrator to specify an arbitrary Git repository URL via admin/updater-handler.php and trigger a system update. The update script verifies the supplied URL and simply clones the repository, overwriting key directories including plugins/, admin/, and includes/ without validating the repository's identity or signature. As router.php permits execution of existing PHP files in plugins, the attacker can inject malicious PHP into the update and gain arbitrary code execution with the web server's privileges, establishing a persistent backdoor.

FearlessCMS installations version 0.1.2b and earlier are vulnerable. The issue is fixed in 0.1.3b; upgrading to this or a later version removes the insecure update path.

With a CVSS score of 9.1 the vulnerability is classified as critical. EPSS is not available and it is not listed in the CISA KEV catalog. The attack requires administrative authentication, so an attacker must first gain privileged access to trigger the exploit. Once successful, the attacker can execute arbitrary PHP code with the web server's privileges, providing full control over the website and potentially the underlying system. Until the vendor releases an update, the risk remains high.