CVE-2026-127058
MEDIUM
NVD
CVSS Score
4.9
Severity
MEDIUM
Published
Nov 12, 2026
Vendor
unknown
Description
WonderCMS before 3.7.0 contains an unverified password change vulnerability in the saveAction functionality that allows an authenticated attacker to change the administrator password without re-authentication. Attackers can exploit this missing re-verification check during password changes to bypass re-authentication controls and maintain or escalate unauthorized access to the administrative account.