The vulnerability CVE-2026-7043 affects GreenCMS versions 2.0 through 2.3 in the pluginAddLocal function accessed via /index.php?m=admin&c=custom&a=pluginadd. It allows an attacker with limited privileges to upload files without restriction, potentially leading to unauthorized code execution or other impacts. The vulnerability is remotely exploitable without user interaction and has a CVSS 4.0 base score of 5.3 (medium severity). The affected GreenCMS versions are no longer supported by the maintainer, and no official fix or patch has been published.

Successful exploitation of this vulnerability could allow an attacker to upload arbitrary files to the affected GreenCMS installations, potentially leading to unauthorized code execution or further compromise. Since the affected versions are unsupported, users remain exposed unless they upgrade to a non-affected system or implement custom mitigations. There are no known exploits in the wild at this time, but public exploit details have been disclosed.

No official patch or remediation is available because the affected GreenCMS versions are no longer supported. Users should consider upgrading to a supported CMS or applying custom access controls to restrict access to the vulnerable plugin addition functionality. Monitoring for suspicious file uploads and restricting administrative access may help reduce risk. Patch status is not yet confirmed—check the vendor advisory or community sources for any updates.