CVE-2026-53952
GetSimple CMS & GetSimpleCMS-CE have an Unauthenticated Admin Account Creation via Setup Logic Flaw
GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. A logic flaw in GetSimple CMS (v3.4.0a and below) and GetSimpleCMS-CE (v3.3.22 and below) allows unauthenticated attackers to create a new administrator account. The application features an automated security control designed to delete the sensitive `admin/setup.php` file post-installation. However, this control is neutralized by a self-exclusion bug within the deletion logic, leaving the setup script accessible for unauthorized account creation even after a legitimate installation is completed. As of time of publication, no known patched versions are available.
| CWE | CWE-285 CWE-306 CWE-489 |
| Vendor | getsimplecms-ce |
| Product | getsimplecms-ce |
| Published | Sep 11, 2026 |
| Last Updated | Sep 14, 2026 |
Get instant alerts for getsimplecms-ce getsimplecms-ce
Be the first to know when new critical vulnerabilities affecting getsimplecms-ce getsimplecms-ce are published — delivered to Slack, Telegram or Discord.
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H