CVE-2026-78834

Deferred Deferred - Pending Action

Authenticated Code Execution in CMSimple via CoAuthors Plugin

Publication date: 2026-09-08

Last updated on: 2026-09-09

Assigner: MITRE

Description

A code execution vulnerability exists in CMSimple 5.22 in the CoAuthors plugin. An authenticated low-privileged user who can modify page content and provide controlled imported content can trigger server-side execution by referencing crafted external or uploaded text content through the affected content import feature.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-09

Generated

2026-09-29

AI Q&A

2026-09-09

EPSS Evaluated

2026-09-27

NVD

CVE-2026-78834

Affected Vendors & Products

Vendor	Product	Version / Range
cmsimple	cmsimple	5.22

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

CVE-2026-78834 is a code execution vulnerability in CMSimple 5.22's CoAuthors plugin. An authenticated low-privileged user with page modification rights can exploit the content import feature to execute arbitrary PHP code on the server by providing crafted external or uploaded text content.

Detection Guidance

Check for unauthorized PHP code execution in CMSimple 5.22 by inspecting uploaded files in the downloads directory for suspicious content like `{{{function:phpversion();}}}` or `{{{plugin:co_authorsURL('./userfiles/downloads/Poc_RCE.txt');}}}`. Review server logs for unexpected PHP function calls or plugin executions.

Impact Analysis

This vulnerability allows attackers to execute arbitrary code on the server, potentially leading to full system compromise. Attackers could steal sensitive data, install malware, or take control of the entire server. It may also enable unauthorized access to other systems connected to the same network.

Compliance Impact

This vulnerability could lead to severe compliance violations under GDPR and HIPAA due to unauthorized data access or exfiltration. GDPR requires protecting personal data, and HIPAA mandates safeguarding health information. A successful exploit may result in data breaches, triggering legal penalties, fines, and reputational damage for affected organizations.

Mitigation Strategies

Immediately update CMSimple to the latest version if available. Disable the CoAuthors plugin if not required. Restrict file upload permissions to prevent unauthorized file modifications. Monitor server logs for suspicious activity and revoke default credentials.

Hi! I’m here to help you understand CVE-2026-78834. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70