VulnSocial

CVE-2026-53952Active Exploitation

MEDIUMCVSS 9.8 · CRITICAL

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

  • Patch affected systems immediately
  • Assume compromise if assets are exposed
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. A logic flaw in GetSimple CMS (v3.4.0a and below) and GetSimpleCMS-CE (v3.3.22 and below) allows unauthenticated attackers to create a new administrator account. The application features an automated security control designed to delete the sensitive `admin/setup.php` file post-installation. However, this control is neutralized by a self-exclusion bug within the deletion logic, leaving the setup script accessible for unauthorized account creation even after a legitimate installation is completed. As of time of publication, no known patched versions are available.

Back to dashboard
5.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-285CWE-306CWE-489

Priority

MEDIUM

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

NONE

Threat summary

  • Active exploitation appears in 1 classified signals
  • Public PoC is present in monitored signal
  • Patch or workaround signal is available
  • 1 mentions across 1 observed day

What's happening

  • Active exploitation reported across 1 signal
  • PoC mentioned or linked in 1 signal
  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 1 signal
  • 1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-09-12: 1PoC Mentioned / Linked · 2026-09-12: 1Active Exploitation · 2026-09-12: 1Patch / Workaround · 2026-09-12: 1Technical Details · 2026-09-12: 109-12
Signal classification1 categories
Active Exploitation
1100.0%
Referenced assets1 URL
Full discourse1 post
  • Rıdvan Yağlı@ridvanyagli
    Active Exploitation

    🔴 GetSimple CMS'te kritik güvenlik açığı: CVE-2026-53952 (CVSS 9.8). Saldırganlar, herhangi bir hesap veya giriş yapmadan GetSimple CMS'teki admin/setup.php işlevini kötüye kullanarak yeni bir yönetici hesabı oluşturabiliyor. Oluşturulan yönetici hesabı, yerleşik tema düzenleme özelliği kullanılarak RCE'ye kadar ilerletilebiliyor. 🔴 Etkilenen: • GetSimple CMS ≤ 3.4.0a • GetSimpleCMS-CE ≤ 3.3.22 ⚠️ Bu açık için resmi patched version bulunmuyor! admin/setup.php erişimini engelleyin/kaldırın ve mevcut yönetici hesapları ile logları kontrol edin. https://github.com/GetSimpleCMS-CE/GetSimpleCMS-CE/security/advisories/GHSA-rw2c-w4mg-46g4

    Post summary

    CVE-2026-53952 enables unauthenticated attackers to create an admin account via admin/setup.php and then achieve remote code execution through theme editing. No patch exists; administrators should disable admin/setup.php and audit accounts and logs.

    100146854
    2.4K followersView on X

Explore more

Back to dashboard