CVE-2026-30457 is a critical remote code execution vulnerability affecting Daylight Studio FuelCMS version 1.5.2. The flaw exists in the /parser/dwoo component, where attackers can supply crafted PHP code that gets executed on the server. This vulnerability has no required privileges or user interaction and can be exploited over the network, leading to full compromise of the affected system. The vulnerability is classified under CWE-94 (Improper Control of Generation of Code). No patch or official fix has been documented in the provided data.

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary PHP code on the affected server, resulting in complete compromise of confidentiality, integrity, and availability. This can lead to data theft, system manipulation, or denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable component if possible and monitor for suspicious activity related to the /parser/dwoo endpoint. Avoid exposing the vulnerable version (1.5.2) to untrusted networks.