PT-2025-38162 · Wondercms · Wondercms

Thawphone · Published 2025-09-17 · Updated 2025-09-19 · CVE-2025-57055

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions WonderCMS version 3.5.0

Description WonderCMS version 3.5.0 is vulnerable to Server-Side Request Forgery (SSRF) in the custom module installation functionality. An authenticated administrator can supply a malicious URL via the pluginThemeUrl POST parameter. The server fetches the provided URL using the curl exec() function without sufficient validation, allowing an attacker to force internal or external HTTP requests.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2025-57055

Affected Products

Wondercms

References · 5

• 🔥 https://github.com/thawphone/CVE-2025-57055 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-57055 · Security Note
• https://osv.dev/vulnerability/CVE-2025-57055 · Vendor Advisory
• https://t.me/CVEtracker/32764 · Telegram Post
• https://twitter.com/CVEnew/status/1969110932564689030 · Twitter Post