CVE-2026-30457 is a critical remote code execution vulnerability in the /parser/dwoo component of Daylight Studio FuelCMS version 1.5.2. The flaw allows attackers to execute arbitrary PHP code by providing specially crafted input, exploiting improper code generation control (CWE-94). The vulnerability has a CVSS 3.1 score of 9.8, reflecting its ease of exploitation and severe impact. No official patch or fix has been disclosed, and no known active exploitation has been reported.

Successful exploitation of this vulnerability could lead to full system compromise, including unauthorized disclosure, modification, or destruction of data, and disruption of service. The vulnerability requires no privileges and no user interaction, making it highly dangerous if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to the vulnerable /parser/dwoo component if possible, and monitor for any updates from the vendor. No official mitigation or temporary fix has been provided at this time.