CVE-2025-34506: Wbce CMS

High severity, CVSS 8.8. EPSS: 0.9% chance of exploitation in the next 30 days.

WBCE CMS version 1.6.3 and prior contains an authenticated remote code execution vulnerability that allows administrators to upload malicious modules. Attackers can craft a specially designed ZIP module with embedded PHP reverse shell code to gain remote system access when the module is installed.

Affected products

• Wbce Wbce CMS: up to and including 1.6.3

Published 2025-12-11. Last modified 2026-10-07.