WonderCMS security vulnerabilities

WonderCMS is an open source PHP-based content management system CMS from WonderCMS, Inc. A security vulnerability exists in WonderCMS version 3.5.0, which stems from insufficient validation of the pluginThemeUrl parameter in the custom module installation feature, which could lead to a server-sid...

CVE-2025-57055

WonderCMS version 3.5.0 is vulnerable to Server-Side Request Forgery (SSRF) within its custom module installation functionality. An authenticated administrator can submit a malicious URL via the pluginThemeUrl POST parameter, which the server fetches using curl_exec() without sufficient validatio...

CVE-2025-57055

WonderCMS 3.5.0 is vulnerable to Server-Side Request Forgery SSRF in the custom module installation functionality. An authenticated administrator can supply a malicious URL via the pluginThemeUrl POST parameter. The server fetches the provided URL using curlexec without sufficient validation,...

PT-2025-38162

Name of the Vulnerable Software and Affected Versions: WonderCMS version 3.5.0 Description: WonderCMS version 3.5.0 is vulnerable to Server-Side Request Forgery SSRF in the custom module installation functionality. An authenticated administrator can supply a malicious URL via the pluginThemeUrl...