CVE-2026-12066 is a vulnerability affecting PbootCMS up to version 3.2.12 in the password recovery functionality located in apps/home/controller/MemberController.php. The issue arises from improper handling of input parameters (username, password, email, checkcode) that weakens the password recovery process, allowing remote attackers to potentially bypass intended security controls. The vulnerability has a CVSS 4.0 score of 6.9 (medium severity) and is exploitable without privileges or user interaction. Public exploit code exists, increasing the risk of attack. No vendor-provided patch or official remediation level is documented.

Successful exploitation of this vulnerability could allow an attacker to bypass or weaken the password recovery mechanism, potentially leading to unauthorized account access. This compromises user account security and may facilitate further unauthorized actions within affected PbootCMS installations. The vulnerability is remotely exploitable without authentication or user interaction, increasing its risk profile. However, no confirmed active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the password recovery functionality or implementing additional verification controls if possible. Monitoring for unusual password recovery requests may help detect exploitation attempts. Avoid relying solely on the vulnerable password recovery process for account security.