Description
WBCE CMS is a content management system. Versions 1.6.4 and below use function GenerateRandomPassword() to create passwords using PHP's rand(). rand() is not cryptographically secure, which allows password sequences to be predicted or brute-forced. This can lead to user account compromise or privilege escalation if these passwords are used for new accounts or password resets. The vulnerability is fixed in version 1.6.5.
Affected products
wbce: wbce cms
References5
- github.com/WBCE/WBCE_CMS/security/advisories/GHSA-76gj-pmvx-jcc6 ExploitVendor Advisory
- github.com/WBCE/WBCE_CMS/security/advisories/GHSA-76gj-pmvx-jcc6 ExploitVendor Advisory
- github.com/WBCE/WBCE_CMS/commit/5d59fe021a5c6e469b1bf192b72ca65… Patch
- cwe.mitre.org/data/definitions/338.html Technical Description
- github.com/WBCE/WBCE_CMS/releases/tag/1.6.5 Release Notes
Metrics
- CVSS 3.1
-
9.8
CRITICAL
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS — exploit probability
- 1% percentile: 47 · as of 11 November 2026
- CWE
- CWE-331CWE-338
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.