The vulnerability CVE-2025-60954 affects Microweber CMS version 2.0 by allowing users to set passwords without any enforced minimum length or complexity requirements during password resets. This means that passwords can be as weak as a single character, drastically reducing the security posture of user accounts, including those with administrative privileges. Weak passwords are susceptible to brute force attacks, dictionary attacks, and credential stuffing, which can lead to unauthorized access. Since administrative accounts can be compromised, attackers could gain full control over the CMS, potentially leading to data breaches, website defacement, or further exploitation within the hosting environment. The vulnerability does not require sophisticated exploitation techniques or advanced privileges to be exploited; it only requires the ability to reset passwords, which is typically available to users. No CVSS score has been assigned yet, and no patches or known exploits have been reported. However, the lack of password complexity enforcement is a fundamental security flaw that undermines the authentication mechanism of the CMS.

For European organizations using Microweber CMS 2.0, this vulnerability could lead to unauthorized access to sensitive data, disruption of web services, and potential compromise of backend systems if administrative accounts are hijacked. The impact is particularly severe for organizations that rely on the CMS for critical communications, e-commerce, or data management. Attackers exploiting weak passwords could manipulate website content, inject malicious code, or exfiltrate confidential information. This could result in reputational damage, regulatory penalties under GDPR due to data breaches, and financial losses. The ease of exploitation increases the likelihood of automated attacks targeting vulnerable installations across Europe. Organizations with limited cybersecurity maturity or without multi-factor authentication are at heightened risk.

Organizations should immediately enforce strong password policies within Microweber CMS, including minimum password length (e.g., at least 12 characters), complexity requirements (mix of uppercase, lowercase, numbers, and symbols), and disallowing common or easily guessable passwords. Implementing multi-factor authentication (MFA) for all user accounts, especially administrators, is critical to reduce the risk of account compromise. Regularly audit user accounts for weak passwords and reset them proactively. Monitor authentication logs for unusual login attempts or brute force activity. If possible, update or patch the CMS once a fix is released by the vendor. Additionally, consider restricting password reset functionality to verified users and employing CAPTCHA or rate limiting to prevent automated attacks. Educate users on the importance of strong passwords and secure credential management.