CVE-2025-67504 is a critical (CVSS 9.1) weak randomness flaw in WBCE CMS 1.6.4 and below. Its GenerateRandomPassword function uses PHP rand, so generated passwords can be predicted by an attacker. Upgrade to 1.6.5, then reset any passwords that the old code created.
What's affected
WBCE CMS versions 1.6.4 and below. The record and the GitHub advisory agree that version 1.6.5 fixes the problem, and both score it 9.1, critical.
The vulnerable function creates passwords for new accounts and password resets. The advisory points to the forgot password page of the admin login as the place where it is used. Any account whose password came from that function after a reset is the account to worry about.
How to check if you're exposed
Check the version in the WBCE admin area, or read it from the files on the server. Then look for the old pattern in your own copy of the code:
grep -rn "GenerateRandomPassword" .
grep -rn "rand(0,70)" wbce/admin
If the first search finds the function and your version is 1.6.4 or older, you run the vulnerable code. Also check for custom plugins that copied the same helper, since this pattern is easy to duplicate.
What to do now
- Upgrade WBCE CMS to 1.6.5 or later.
- Force password resets for all accounts, with priority for administrators, since earlier generated passwords may be predictable.
- Require users to choose their own long passwords instead of accepting generated ones.
- Enable multi factor authentication for admin access where your setup supports it.
- Search custom code for other uses of rand or mt_rand in security contexts and replace them with random_int or random_bytes.
Why it matters
The weaknesses are CWE-331, insufficient entropy, and CWE-338, use of a cryptographically weak pseudo random number generator. PHP's rand is built for games and shuffling, not secrets. Its output follows a pattern that can be worked out from observed values.
The advisory recommends random_int or random_bytes, longer passwords and a standard password generation library. The lesson holds beyond one CMS: any token, password or reset link must come from a cryptographically secure source. The record does not list this CVE as known exploited.
Two details help with triage. The advisory points to the forgot password page of the admin login, so reset flows are the most likely place where predictable values were handed out. And because the fix is small, a one line change from rand to a secure source, the upgrade carries little regression risk for most sites.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is upgrading enough?
The upgrade stops new weak passwords. Passwords generated earlier may still be predictable, so reset them.
Which PHP functions are safe for secrets?
The advisory recommends random_int and random_bytes.
Sources
- Safeguard Gold page for CVE-2025-67504
- GitHub security advisory GHSA-76gj-pmvx-jcc6
- WBCE CMS 1.6.5 release (listed in the record)
Last reviewed: 18 October 2026.
