CVE-2025-67436: PluXml CMS · Command Injection
Source CVE Database V5
Not known to be exploited · CVSS 6.5 Medium.
Data as of 26 Oct 2026, 17:16 UTC
- EPSS
- 0.5% chance of exploitation in 30 days – higher than 47% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:NExploitation evidence
Disclosed: evidence found.
CVE published 22 Dec 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
AI-suggested
- Restrict administrator panel access by implementing strong authentication mechanisms, such as multi-factor authentication (MFA), and limiting access via IP whitelisting or VPNs.
- Regularly audit and monitor file integrity of theme and core CMS files to detect unauthorized modifications, using tools like Tripwire or OSSEC.
- Enforce the principle of least privilege by ensuring only necessary users have administrator rights.
- Harden the web server environment by disabling unnecessary PHP functions and restricting file write permissions to theme directories.
- Monitor web server logs for suspicious activity indicative of webshell deployment or command execution.
- Educate administrators on phishing and credential security to reduce risk of compromised credentials.
- Prepare for patch deployment by tracking vendor updates and testing patches in a staging environment before production rollout.
- Consider isolating the CMS environment using containerization or network segmentation to limit lateral movement if compromised.
Description
Authenticated Remote Code Execution (RCE) in PluXml CMS 5.8.22 allows an attacker with administrator panel access to inject a malicious PHP webshell into a theme file (e.g., home.php).