CVE-2026-88418

Name of the Vulnerable Software and Affected Versions CMSimple version 5.24

Description CSRF protection is disabled by default, rendering the csrfProtection() function ineffective for state-changing admin requests and omitting the csrf token hidden field in admin forms. Since administrator authentication relies solely on cookies without CSRF token enforcement, an unauthenticated attacker can trick a logged-in administrator's browser into sending a forged content-save request. This request can include a text payload with a scripting marker that is stored in content/content.php. Subsequently, the evaluate cmsimple scripting() function in functions.php executes the marker body using PHP eval(), allowing persistent remote code execution on the web server for all visitors.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.