CVE-2026-108811: Information Disclosure in WMCMS

This vulnerability in WMCMS 4.446.1257 involves an unknown function in /index.php that improperly handles the path/file argument, allowing remote attackers to disclose sensitive information. The attack vector is network-based, with no user interaction required, and the attack complexity is low. Privileges required are low, and the vulnerability has low impact on confidentiality. Exploit code has been publicly released, increasing the risk of exploitation.

Successful exploitation results in information disclosure, potentially exposing sensitive data to remote attackers. The impact on confidentiality is low, and there is no direct impact on integrity or availability. The vulnerability requires low privileges and no user interaction, making it easier to exploit remotely. However, no known exploits are currently observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected WMCMS instance and monitor for suspicious activity related to manipulation of the path/file argument in /index.php. Avoid exposing the vulnerable version publicly if possible.