CVE-2025-67504: Wbce CMS

Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days.

WBCE CMS is a content management system. Versions 1.6.4 and below use function GenerateRandomPassword() to create passwords using PHP's rand(). rand() is not cryptographically secure, which allows password sequences to be predicted or brute-forced. This can lead to user account compromise or privilege escalation if these passwords are used for new accounts or password resets. The vulnerability is fixed in version 1.6.5.

Affected products

• Wbce Wbce CMS: before 1.6.5 (fixed in 1.6.5)

Published 2025-12-09. Last modified 2026-10-07.