CVE-2025-13786 is a high severity code injection flaw (CVSS 7.3) in taosir WTCMS (builds up to commit 01a5f68a3dfc2fdddb44eed967bb2d4f60487665), affecting the fetch function in /index.php, through the content argument. No version is listed because releases roll, so verify your code and restrict access.
What's affected
The affected component is the fetch function in /index.php, through the content argument. The record says that manipulating that argument results in code injection and that the attack can be initiated remotely.
Affected version: builds up to commit 01a5f68a3dfc2fdddb44eed967bb2d4f60487665. The record says the project uses rolling releases, so no version details are given for affected or updated builds, and that the vendor did not respond to the disclosure.
The CVSS vector is AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. The attack vector is the network, and the vector lists no privileges required, so an unauthenticated visitor who can reach the service is in scope. The weakness classes are CWE-74, CWE-94.
The CVE record states that the exploit has been disclosed publicly. That is not the same as exploitation in the wild, which the record does not report, and the CISA Known Exploited Vulnerabilities flag is false. Still, public details lower the effort needed to attack an exposed instance.
How to check if you're exposed
WTCMS is a PHP content management system, and the record identifies it by commit instead of release number. That makes version checking a matter of looking at your source tree.
git -C /var/www/wtcms log -1 --format=%H
git -C /var/www/wtcms merge-base --is-ancestor 01a5f68a3dfc2fdddb44eed967bb2d4f60487665 HEAD && echo "at or after the named commit"
If your copy is not a git checkout, compare file dates and ask whoever deployed it where the code came from. Then check whether the site is reachable from the internet and look at access logs for odd requests to the front controller with a long or encoded content parameter.
grep "content=" /var/log/nginx/access.log | awk 'length($0) > 400' | head
Long encoded values are not proof of abuse, but they are worth reading.
What to do now
- Find every WTCMS deployment and record which commit it runs.
- Put the site behind a VPN, an allowlist or at least a web application firewall rule while you investigate.
- Review the template fetch logic in the affected code. User input should never be treated as template or PHP source.
- Run the web server under a low-privilege account and make web directories read only where possible, so injected code has little to work with.
- Look for unexpected files in the web root and for new administrator accounts, and restore from a clean backup if you find any.
- Track the upstream repository for a fix, and update when one is published.
Why it matters
Code injection is the weakness where input is treated as code and executed by the application. Here it is catalogued as CWE-74, CWE-94. The consequence can be far larger than the CVSS 7.3 figure implies, because code that runs in the web application can reach everything the web application can reach: its database credentials, its files and often other services.
The record's rolling release note means there are no fixed version numbers to track. Users of software like this have to be prepared to read the code and patch it themselves, or to retire it.
Try it yourself
The demo shows how a watch on new disclosures turns a fresh CVE into an actionable list.
Click through it at your own pace, or open it full screen.
Quick check
Why are there no version numbers?
The record says the project uses rolling releases, so no version details are given for affected or updated builds, and that the vendor did not respond to the disclosure.
Is code injection worse than SQL injection?
It usually has a larger ceiling, because the attacker's input runs as code instead of changing a query. The CVSS vector for this record lists limited impact on each of confidentiality, integrity and availability, so check your own exposure rather than trusting the number alone.
Sources
- Gold vulnerability page for CVE-2025-13786
- CVE record for CVE-2025-13786 as published by its CNA, with a published date of 2025-11-30
- Free in-browser dependency scan: gold.safeguard.sh/scan
Last reviewed: 19 October 2026.
