CVE-2022-46020

Think of your website's upload feature like a mail room that's supposed to check what's inside every package before accepting it. This flaw means the mail room only checks the label, not the contents — so someone can mail in a bomb disguised as a harmless parcel and it gets let straight through, giving them control of the whole building.

This matters to you if you run a website built on WBCE CMS, particularly version 1.5.4. The upload flaw works without any login or special access, and is reachable by anyone on the internet with no special conditions needed — if your site is publicly accessible, it's exposed.

This is a serious, actively discussed vulnerability — a public proof-of-concept exploit is already available online, and there's been sustained press attention around it, meaning attackers have the tools and motivation to try it. It has not yet been confirmed as exploited in real attacks, but you should treat it as a priority to address soon rather than urgently tonight.

Confirm exposure by identifying all WBCE CMS instances and checking the version against 1.5.4. There is currently no documented official patch for this CWE-434 (unrestricted upload of dangerous file type) issue — monitor the WBCE CMS GitHub repository and release notes closely for a fix. As an interim mitigation: disable or heavily restrict the file upload functionality in the admin panel, enforce server-side MIME-type and content validation independent of the application (e.g., via web server config or a reverse proxy), and place the admin/upload endpoints behind authentication or IP allowlisting at the network layer. A public PoC exists on GitHub, so assume exploitation attempts may occur; monitor web server logs for unexpected file uploads with unusual extensions or double extensions (e.g., .php.jpg), and watch for new/unexpected files appearing in upload directories. Not listed in CISA KEV, so there is no federal remediation deadline, but given the critical severity (CVSS 9.8) and public exploit code, prioritize this above routine patching cycles.

CVSS 3.1 score 9.8 (Critical) — network-exploitable, no privileges or user interaction required, full impact to confidentiality, integrity, and availability. Weakness: CWE-434 (Unrestricted Upload of File with Dangerous Type), triggered by insufficient validation of uploaded file types, allowing webshell upload. A public proof-of-concept exploit exists on GitHub, indicating exploit maturity has progressed beyond theoretical. EPSS places this in the 99th percentile of exploitation likelihood, though the trend is currently falling and it is not listed in CISA's Known Exploited Vulnerabilities catalog, so there is no confirmed in-the-wild exploitation at this time. No vendor patch has been published as of the latest findings.