CVE-2025-67504 WBCE CMS has Weak Random Number Generator in Password Generation Function
Attackers can predict generated passwords due to insecure random number generation, leading to account takeover or privilege escalation in WBCE CMS.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-67504?
CVE-2025-67504 is a critical vulnerability in WBCE_CMS, published on 9 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
WBCE CMS is a content management system. Versions 1.6.4 and below use function GenerateRandomPassword() to create passwords using PHP's rand(). rand() is not cryptographically secure, which allows password sequences to be predicted or brute-forced. This can lead to user account compromise or privilege escalation if these passwords are used for new accounts or password resets. The vulnerability is fixed in version 1.6.5.
Which versions are affected by CVE-2025-67504?
It affects 1 product.
Products include Wbce Wbce Cms.
How do I fix CVE-2025-67504?
No fix has been published for CVE-2025-67504 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-67504 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-67504 exists.
Other vulnerabilities in WBCE_CMS
Sources
Also known as GHSA-76gj-pmvx-jcc6.