CVE-2026-30460 is an authenticated remote code execution vulnerability affecting Daylight Studio FuelCMS version 1.5.2 specifically in the Blocks module. An attacker with valid user privileges can exploit this flaw to execute arbitrary code remotely, potentially compromising confidentiality, integrity, and availability of the system. The vulnerability is classified under CWE-94 (Improper Control of Generation of Code). There is no vendor advisory or patch currently available to address this issue.

Successful exploitation of this vulnerability could lead to full system compromise, including unauthorized disclosure, modification, or destruction of data, and disruption of service. Since the vulnerability requires authentication, the attacker must have valid credentials, but once exploited, the impact is critical due to the ability to execute arbitrary code remotely.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, restrict access to the Blocks module to trusted users only and monitor for suspicious activity involving authenticated users. Avoid exposing the application to untrusted networks if possible.