CVE-2026-127058

MEDIUM 4.9

WonderCMS before 3.7.0 Unverified Password Change via saveAction

CVSS Score

4.9

EPSS Score

0.0%

EPSS Percentile

0th

WonderCMS before 3.7.0 contains an unverified password change vulnerability in the saveAction functionality that allows an authenticated attacker to change the administrator password without re-authentication. Attackers can exploit this missing re-verification check during password changes to bypass re-authentication controls and maintain or escalate unauthorized access to the administrative account.

CWE	CWE-620
Vendor	wondercms
Product	wondercms
Published	Nov 12, 2026

Stay Ahead of the Next One

Get instant alerts for wondercms wondercms

Be the first to know when new medium vulnerabilities affecting wondercms wondercms are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Affected Versions

WonderCMS / wondercms

0 < 3.7.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/WonderCMS/wondercms/security/advisories/GHSA-qc3r-v7fc-24xc github.com: https://github.com/WonderCMS/wondercms/releases#release-3.7.0 vulncheck.com: https://www.vulncheck.com/advisories/wondercms-before-unverified-password-change-via-saveaction

Credits

🔍 Harsh Raj Singhania manop55555