CVE-2026-127058

Name of the Vulnerable Software and Affected Versions WonderCMS versions prior to 3.7.0

Description The saveAction functionality allows an authenticated attacker to change the administrator password without re-authentication. This occurs due to a missing re-verification check during the password change process, enabling attackers to bypass authentication controls and maintain or escalate unauthorized access to the administrative account.

Recommendations Update to version 3.7.0 or later.