CVE-2025-15226

CriticalCVSS 9.8

Published: 29/12/2025(UTC)Updated: 07/10/2026(UTC)Translated: 05/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.59%

47th percentile - higher than 47% of all known CVEs

Summary

WMPro developed by Sunnet has an Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.

Risk Assessment

An attacker can gain full control of the server, potentially compromising the confidentiality, integrity, and availability of data and services.

Recommendation

Immediately update WMPro to the latest version if available, and restrict access to the application to trusted users only.

Other vulnerabilities in WMPro

CVE-2025-15225High
WMPro developed by Sunnet has an Arbitrary File Read vulnerability, allowing unauthenticated remote attackers to exploit Relative Path Traversal to read arbitrary system files.

Original NVD description (English source)

WMPro developed by Sunnet has a Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS