CVE-2025-34506

WBCE CMS 1.6.3 Authenticated Remote Code Execution via Module Upload

WBCE CMS version 1.6.3 and prior contains an authenticated remote code execution vulnerability that allows administrators to upload malicious modules. Attackers can craft a specially designed ZIP module with embedded PHP reverse shell code to gain remote system access when the module is installed.

Affected

WBCE · WBCE CMS

CVSS v4.0 VULNCHECK

8.6 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1 NVD

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.91% chance of exploitation in the next 30 days, 59th percentile

Published

2025-12-11

Updated

2026-04-07

Proof-of-concept exploits (1)

• https://www.exploit-db.com/exploits/52132

Security advisories

• Swammers8/WBCE-v1.6.3-Authenticated-RCE
• https://www.vulncheck.com/advisories/wbce-cms-authenticated-remote-code-execution-via-mod…
• WBCE/WBCE_CMS
• https://wbce-cms.org

References

• CVE Record
• NVD entry