CVE-2025-15226
Critical · CVSS 9.8- CVSS
- 9.8
- nvd
- EPSS
- 0.59%
- 47th pct
- KEV
- No
- Class
- other
- CWE-434
Description
WMPro developed by Sunnet has a Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.
References
Status: profiled · ingested 2026-10-06T00:00:53.000Z