CVE-2025-65094 - CVE House
Back to Database
Status published High CVE-2025-65094

WBCE CMS is Vulnerable to Privilege Escalation via Group ID Manipulation (IDOR)

Vulnerability Description

WBCE CMS is a content management system. Prior to version 1.6.4, a low-privileged user in WBCE CMS can escalate their privileges to the Administrators group by manipulating the groups[] parameter in the /admin/users/save.php request. The UI restricts users to assigning only their existing group, but server-side validation is missing, allowing attackers to overwrite their group membership and obtain full administrative access. This results in a complete compromise of the CMS. This issue has been patched in version 1.6.4.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-65094

Credits & Attribution

No credits recorded in the NVD database.

References

More from WBCE

View All →
CVE-2025-67504
WBCE CMS has Weak Random Number Generator in Password Generation Function
Critical 9.1
CVE-2025-66204
WBCE CMS allows brute-force protection bypass using X-Forwarded-For header
Medium 6.3
CVE-2025-65950
WBCE CMS is Vulnerable to Time-Based Blind SQL Injection through groups[] Parameter
Critical 9.4
CVE-2025-34506
WBCE CMS 1.6.3 Authenticated Remote Code Execution via Module Upload
High 8.6
CVE-2022-4006
WBCE CMS Header class.login.php increase_attempts excessive authentication
Low 3.7

Affected Vendor

Affected Software

WBCE_CMS
Vulnerable Versions:
< 1.6.4

Timeline

Official Publish: November 19th, 2025
Last Modified: November 19th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-266 CWE-285

MITRE ATT&CK TTPs

T1078 Valid Accounts
Persistence
T1098 Account Manipulation
Privilege Escalation
T1548 Abuse Elevation Control Mechanism
Privilege Escalation
T1484 Domain or Tenant Policy Modification
Defense Evasion
T1021 Remote Services
Lateral Movement
T1190 Exploit Public-Facing Application
Initial Access