CVE-2026-127058

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-127058
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-127058.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-127058
Aliases
  • GHSA-qc3r-v7fc-24xc
Published
2026-11-12T13:09:59Z
Modified
2026-11-13T02:45:15Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
WonderCMS before 3.7.0 Unverified Password Change via saveAction
Details

WonderCMS before 3.7.0 contains an unverified password change vulnerability in the saveAction functionality that allows an authenticated attacker to change the administrator password without re-authentication. Attackers can exploit this missing re-verification check during password changes to bypass re-authentication controls and maintain or escalate unauthorized access to the administrative account.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-620"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/127xxx/CVE-2026-127058.json"
}
References

Affected packages

Git / github.com/wondercms/wondercms

Affected ranges

Type
GIT
Repo
https://github.com/wondercms/wondercms
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
d8aec65ebf7958f21c223953ce2e389e18e800e6
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "3.7.0"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        }
    ]
}

Affected versions

1.*
1.1.0-beta
1.2.0-beta
2.*
2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.1.0
2.2.0
2.2.1
2.3.0
2.3.1
2.3.2
2.4.0
2.4.1
2.4.2
2.5.0
2.5.1
2.5.2
2.6.0
2.7.0
3.*
3.0.4
3.0.5
3.0.6
3.0.7
3.0.8
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.3.0
3.3.1
3.3.2
3.3.3
3.3.4
3.4.0
3.4.1
3.4.2
3.4.3
3.5.0
3.6.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-127058.json"