CVE-2026-85138 is a high severity (CVSS 7.3) SQL injection in the WeChat module of SeaCMS up to 13.6, in weixin/index.php. The researcher's advisory says it is reachable only when the module is enabled. No fixed version is confirmed, so disable the module.
What's affected
The record lists SeaCMS up to 13.6, in the addslashes handling of weixin/index.php, part of the WeChat module. Manipulating the Content input results in SQL injection. The record says the attack may be launched remotely and that the exploit is now public.
I fetched the researcher's advisory on GitHub. It says the issue was verified on SeaCMS 13.6 when the WeChat module is enabled, and that the remote default configuration had the module switched off, so the flaw is reachable only after it is turned on. It also says the code does not verify the WeChat signature on ordinary message requests.
Severity conflict: the record scores this 7.3 High. The researcher's own suggested score in that advisory is 6.5, a Medium value with only a confidentiality impact. Both are reported here. I found no vendor advisory or fixed version, so treat the fix status as unknown.
How to check if you're exposed
First, find out whether the WeChat module is on. In a SeaCMS install, the module's settings live in the admin area, and the researcher's advisory refers to an isopen setting in the module's configuration file under data/admin. Check that value on every site:
grep -n "isopen" data/admin/weixin.php
If the module is switched off, the advisory says the flaw is not reachable. If it is on, assume you are exposed. Then check the SeaCMS version in the admin panel or the site files. Any version up to and including 13.6 is in scope. Look at your web logs for unusual requests to the weixin path, and for requests that carry long or odd message bodies.
What to do now
- Turn off the WeChat module on every SeaCMS site that does not need it.
- If you need it, put the weixin path behind a web application firewall rule or restrict it to the addresses WeChat uses.
- Check the SeaCMS project for a newer release, because the record names no fixed version.
- Review database accounts used by SeaCMS and give them only the rights the site needs.
- Look at web logs and the database for unexpected queries or data changes around the weixin path.
Why it matters
The record lists injection, CWE-74, and SQL injection, CWE-89. The researcher's advisory explains the cause at a high level. The code escapes the raw request body first, then parses it as XML. XML parsing can turn character references back into plain characters, including the quote mark that escaping was meant to neutralize, so the escaping is undone before the text reaches the query.
It is a good example of escaping at the wrong moment. The defence has to be applied to the value as it reaches the query, ideally with parameterized queries. The advisory adds that the missing signature check means any caller can post a message. The record says the exploit is public, which is not the same as exploitation in the wild, and the record does not flag CISA.
Quick check
Am I exposed if the WeChat module is off?
The researcher's advisory says the flaw is reachable once the module is enabled, and the remote default had it off. Confirm your setting.
Why do the scores differ?
The record says 7.3, and the researcher suggested 6.5 with confidentiality impact only. Treat it as high until you have the vendor's view.
Sources
- Researcher advisory for SeaCMS 13.6 WeChat module
- VulDB entry for CVE-2026-85138 (listed in the record; blocked when fetched)
Last reviewed: 18 October 2026.
