CVE-2026-127058 json
WonderCMS before 3.7.0 Unverified Password Change via saveAction
published 13d ago modified yesterday also EUVD-2026-124397 , GHSA-qc3r-v7fc-24xc
Unreviewed: the maintainers' own advisory
Published by the maintainers on their GitHub repository WonderCMS/wondercms. GitHub has not reviewed it into the GitHub Advisory Database, so the affected packages and versions are the maintainers' word. Read the full advisory on GitHub.
- cvss
- 4.9
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 24%
- public exploits
- 0
- none known
Summary
WonderCMS before 3.7.0 contains an unverified password change vulnerability in the saveAction functionality that allows an authenticated attacker to change the administrator password without re-authentication. Attackers can exploit this missing re-verification check during password changes to bypass re-authentication controls and maintain or escalate unauthorized access to the administrative account.
Patch / fix
Is CVE-2026-127058 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- yesterday
Exploit prediction
0.32% chance of exploitation in the next 30 days, higher than 24% of all scored CVEs (FIRST EPSS, 2026-11-14).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N |
| CNA | 3.1 | 4.9 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N |
| CNA | 4.0 | 6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected products
- WonderCMS wondercms
Classification
- Weakness
-
- CWE-620 Unverified Password Change
References
-
github.com
/WonderCMS/wondercms/releases#release-3.7.0
release-notes, patch
-
github.com
/WonderCMS/wondercms/security/advisories/GHSA-qc3r-v7fc-24xc
vendor-advisory, advisory
-
vulncheck.com
/advisories/wondercms-before-unverified-password-change-via-saveaction
third-party-advisory
Sources
- CVE List CVE-2026-127058
- NVD CVE-2026-127058
- Maintainer advisory GHSA-qc3r-v7fc-24xc
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
The maintainers of WonderCMS/wondercms published their own advisory on GitHub. Reviewed sources take precedence over it.