CVE-2025-34506 affects WBCE CMS version 1.6.3 and prior, enabling authenticated users with administrative privileges to upload specially crafted ZIP modules that include embedded PHP reverse shell code. Upon installation of such a module, attackers can achieve remote code execution, compromising the underlying system. The root cause is an unrestricted file upload vulnerability classified under CWE-434, which permits dangerous file types to be uploaded without proper validation or restriction.

Successful exploitation allows an attacker with administrative access to execute arbitrary code remotely on the affected server, potentially leading to full system compromise. This elevates the risk profile significantly, especially in environments where administrative credentials may be exposed or compromised. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrative access to trusted users only and monitor for suspicious module uploads. Avoid installing untrusted modules and consider additional application-layer controls to validate uploaded files.