CVE-2025-5149 | WCMS up to 8.3.11 Login getallcon getMemberByUid uid improper authentication

A vulnerability was found in WCMS up to 8.3.11. It has been declared as critical. Affected by this vulnerability is the function getMemberByUid of the file /index.php?articleadmin/getallcon of the component Login. The manipulation of the argument uid leads to improper authentication.

This vulnerability is known as CVE-2025-5149. The attack can be launched remotely. Furthermore, there is an exploit available.

The vendor was contacted early about this disclosure but did not respond in any way.