CVE-2026-28495
CSRF-Enabled Remote Code Execution in GetSimple CMS massiveAdmin Plugin
Publication date: 2026-03-10
Last updated on: 2026-03-12
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| getsimple-ce | getsimple_cms | to 3.3.22 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-352 | The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the massiveAdmin plugin (version 6.0.3) bundled with GetSimpleCMS-CE version 3.3.22. It allows an authenticated administrator to overwrite the gsconfig.php configuration file with arbitrary PHP code through the gsconfig editor module.
The form used for this operation lacks Cross-Site Request Forgery (CSRF) protection, which means a remote unauthenticated attacker can trick a logged-in administrator into executing a malicious request.
By exploiting this vulnerability via CSRF, the attacker can achieve Remote Code Execution (RCE) on the web server, potentially taking full control of the server.
How can this vulnerability impact me? :
This vulnerability can have severe impacts including allowing an attacker to execute arbitrary code on the web server remotely.
- Complete compromise of the web server hosting the GetSimple CMS.
- Potential data theft, data loss, or unauthorized data modification.
- Disruption of website availability or service through malicious actions.
- Use of the compromised server as a pivot point for further attacks within the network.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
I don't know