CVE-2025-13786 taosir WTCMS index.php fetch code injection

Medium 6.9 Published 30 Nov 2025 Updated 1 Dec 2025

Remote attackers can execute arbitrary code via the fetch function in index.php due to improper input handling in WTCMS.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-13786?

CVE-2025-13786 is a medium-severity code injection vulnerability in taosir WTCMS, published on 30 Nov 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A vulnerability was detected in taosir WTCMS up to 01a5f68a3dfc2fdddb44eed967bb2d4f60487665. Impacted is the function fetch of the file /index.php. Performing manipulation of the argument content results in code injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.

Weakness: CWE-94, CWE-74

Which versions are affected by CVE-2025-13786?

It affects 1 product.

Products include Wtcms Project Wtcms.

How do I fix CVE-2025-13786?

No fix has been published for CVE-2025-13786 yet. Limit exposure of the affected software until one is available.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2025-13786 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-13786 exists.

Sources

Also known as GHSA-pvg7-jq3v-hmq6.