CVE-2026-53952
GetSimple CMS versions 3.4.0a and earlier, and GetSimpleCMS-CE 3.3.22 and earlier, contain a logic flaw that lets anyone create an administrator account without authentication. The flaw is caused by a bug that prevents the system from deleting the admin/setup.php file after installation, leaving it accessible. This allows attackers to gain full control of the site.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
GetSimple CMS v3.4.0a and earlier, and GetSimpleCMS-CE v3.3.22 and earlier – typically website owners using these CMS versions.
Real-world impact
An attacker can create a new admin account, giving them full control over the website, including content, plugins, and potentially sensitive data.
Why this severity
The CVSS score of 9.8 reflects that the vulnerability is exploitable over the network with no authentication, and it allows complete compromise of confidentiality, integrity, and availability.
What to do about it
- ›Manually delete or rename the admin/setup.php file to prevent unauthorized account creation.
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources.