CVE-2026-127058
Received Received - Intake

Unauthenticated Password Change in WonderCMS

Publication date: 2026-11-12

Last updated on: 2026-11-12

Assigner: VulnCheck

Description
WonderCMS before 3.7.0 contains an unverified password change vulnerability in the saveAction functionality that allows an authenticated attacker to change the administrator password without re-authentication. Attackers can exploit this missing re-verification check during password changes to bypass re-authentication controls and maintain or escalate unauthorized access to the administrative account.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-12
Last Modified
2026-11-12
Generated
2026-11-12
AI Q&A
2026-11-12
EPSS Evaluated
N/A
NVD
CVE-2026-127058
EUVD
EUVD-2026-124397

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
WonderCMS wondercms From 0 (inc) to 3.7.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-620 When setting a new password for a user, the product does not require knowledge of the original password, or using another form of authentication.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-127058 is an unverified password change vulnerability in WonderCMS versions before 3.7.0. It allows an authenticated attacker to change the administrator password without re-authenticating. The flaw exists in the saveAction functionality, where the system fails to verify the current password before allowing a change. This bypasses authentication controls, enabling attackers to maintain or escalate unauthorized access to the admin account.

Impact Analysis

If exploited, this vulnerability could allow an attacker with access to an admin session to change the admin password without knowing the current one. This could lead to full account takeover, unauthorized modifications to the website, data theft, or further compromise of the system. Attackers could also add malicious modules or maintain persistent access even after password changes.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling unauthorized access to sensitive data. GDPR requires protecting personal data, and HIPAA mandates securing protected health information. A successful exploit could lead to data breaches, violating these regulations and resulting in legal penalties, fines, or reputational damage.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-127058. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...