A vulnerability was found in WCMS up to 8.3.11. It has been declared as critical. Affected by this vulnerability is the function
getMemberByUid
of the file /index.php?articleadmin/getallcon of the component Login. The manipulation of the argument uid leads to improper authentication.
This vulnerability is known as CVE-2025-5149. The attack can be launched remotely. Furthermore, there is an exploit available.
The vendor was contacted early about this disclosure but did not respond in any way.