CVE-2025-15457 is a high severity improper authentication flaw (CVSS 7.3) in bg5sbk MiniCMS up to 1.8. The trash file restore handler in mc-admin/post.php can be used without proper authentication, and the record says an exploit is public. The vendor did not respond and no fix is confirmed.
What's affected
The record lists bg5sbk MiniCMS up to version 1.8. The affected file is /minicms/mc-admin/post.php, in the component the record calls the Trash File Restore Handler. The weakness is improper authentication: the action can be reached without the checks an admin page should enforce.
A related report, CVE-2025-15458, covers post-edit.php in the same product. MiniCMS 1.8 and earlier are in scope for both.
The record states that the vendor did not respond and gives no fixed version. MiniCMS is a small single author CMS, so a maintained upstream patch is unlikely.
How to check if you're exposed
Find MiniCMS installs and their versions:
find / -type d -name "mc-admin" 2>/dev/null
grep -rn "version" */mc-admin/*.php | head
Then check access logs for requests to mc-admin/post.php that came from addresses that never logged in, and compare with your admin session logs. Look at the trash folder or post table for entries restored or changed without a matching admin login.
Also test your own install from a private window: any mc-admin page that answers without prompting for a login is a problem to fix at the web server level.
What to do now
- List every MiniCMS install you operate and its version.
- Block the
mc-admindirectory at the web server for everyone except known admin addresses, or require HTTP authentication in front of it. - Review recent content for edits or restores you did not make and restore from a known good backup if needed.
- Rotate the admin password and any keys stored on the server.
- Plan a move to a maintained CMS, since MiniCMS has no confirmed fix.
Why it matters
The record lists CWE-287, Improper Authentication. Admin actions in a CMS are meant to run only after the session is checked. When one script skips the check, anyone who can reach the URL gets the rights of an admin for that action. Here that action is restoring items from the trash, which changes what the site shows.
The score reflects a network vector, no privileges and low impact on confidentiality, integrity and availability (7.3). It is not in CISA's Known Exploited Vulnerabilities catalog per the record. Content sites are a common defacement target, so checking for unwanted changes matters more than the score suggests.
Quick check
Is there a MiniCMS update?
None is confirmed. The record says versions up to 1.8 are affected and the vendor did not respond.
Is blocking mc-admin enough?
It removes the described path for outsiders. Check for unwanted changes and plan a move to a maintained system.
Sources
Last reviewed: 19 October 2026.
