Vulnerability · Published Jan 13, 2026 · Assigned by VulnCheck
CVE-2022-50936WBCE CMS 1.5.2 - Remote Code Execution (RCE) (Authenticated)
High 8.8
In plain English
A high-severity unrestricted file upload in WBCE CMS from Wbce. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 61% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.9%top 39.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
WBCE CMS version 1.5.2 contains an authenticated remote code execution vulnerability that allows attackers to upload malicious droplets through the admin panel. Authenticated attackers can exploit the droplet upload functionality in the admin tools to create and execute arbitrary PHP code by crafting a specially designed zip file payload.
Affected products (as reported)
Weakness: CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- ExploitDB-50707 exploit
- WBCE CMS Official Website product
- WBCE CMS Downloads Page product
- WBCE CMS GitHub Repository product
- VulnCheck Advisory: WBCE CMS 1.5.2 - Remote Code Execution (RCE) (Authenticated) third-party-advisory