CVE-2026-28495
Received Received - Intake
CSRF-Enabled Remote Code Execution in GetSimple CMS massiveAdmin Plugin

Publication date: 2026-03-10

Last updated on: 2026-03-12

Assigner: GitHub, Inc.

Description
GetSimple CMS is a content management system. The massiveAdmin plugin (v6.0.3) bundled with GetSimpleCMS-CE v3.3.22 allows an authenticated administrator to overwrite the gsconfig.php configuration file with arbitrary PHP code via the gsconfig editor module. The form lacks CSRF protection, enabling a remote unauthenticated attacker to exploit this via Cross-Site Request Forgery against a logged-in admin, achieving Remote Code Execution (RCE) on the web server.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-10
Last Modified
2026-03-12
Generated
2026-06-16
AI Q&A
2026-03-10
EPSS Evaluated
2026-06-15
NVD
CVE-2026-28495
EUVD
EUVD-2026-10811
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
getsimple-ce getsimple_cms to 3.3.22 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in the massiveAdmin plugin (version 6.0.3) bundled with GetSimpleCMS-CE version 3.3.22. It allows an authenticated administrator to overwrite the gsconfig.php configuration file with arbitrary PHP code through the gsconfig editor module.

The form used for this operation lacks Cross-Site Request Forgery (CSRF) protection, which means a remote unauthenticated attacker can trick a logged-in administrator into executing a malicious request.

By exploiting this vulnerability via CSRF, the attacker can achieve Remote Code Execution (RCE) on the web server, potentially taking full control of the server.

Impact Analysis

This vulnerability can have severe impacts including allowing an attacker to execute arbitrary code on the web server remotely.

  • Complete compromise of the web server hosting the GetSimple CMS.
  • Potential data theft, data loss, or unauthorized data modification.
  • Disruption of website availability or service through malicious actions.
  • Use of the compromised server as a pivot point for further attacks within the network.
Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

I don't know

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-28495. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart