PatchTheCVEwtcms vulnerabilities and fixes
Recent CVEs affecting wtcms, with upgrade or downgrade steps. 6 tracked.
wtcms has 6 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 3. Most recent: 2025-11-30. Highest priority: CVE-2024-48237 (score 54/100).
- CVE-2025-13786 HIGH 7.3 UPGRADE A vulnerability was detected in taosir WTCMS up to 01a5f68a3dfc2fdddb44eed967bb2d4f60487665
- CVE-2025-13783 MEDIUM 6.3 UPGRADE A security flaw has been discovered in taosir WTCMS up to 01a5f68a3dfc2fdddb44eed967bb2d4f60487665
- CVE-2025-13782 HIGH 7.3 UPGRADE A vulnerability was identified in taosir WTCMS up to 01a5f68a3dfc2fdddb44eed967bb2d4f60487665
- CVE-2024-48239 MEDIUM 4.8 DOWNGRADE An issue was discovered in WTCMS 1.0
- CVE-2024-48238 MEDIUM 4.7 DOWNGRADE WTCMS 1.0 is vulnerable to SQL Injection in the edit_post method of /Admin\Controller\NavControl.class.php via
- CVE-2024-48237 CRITICAL 9.8 DOWNGRADE WTCMS 1.0 is vulnerable to Incorrect Access Control in \Common\Controller\HomebaseController.class.php.
FAQ
How do I fix wtcms vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is wtcms being exploited right now?
None of the tracked wtcms CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which wtcms CVE should I patch first?
CVE-2024-48237 currently ranks highest (54/100): WTCMS 1.0 is vulnerable to Incorrect Access Control in \Common\Controller\HomebaseController.class.php..