CVE-2025-15226

Critical

Published: 29/12/2025(UTC)Translated: 05/08/2026(UTC)NVD NIST

Summary

WMPro developed by Sunnet has an Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.

Risk Assessment

An attacker can gain full control of the server, potentially compromising the confidentiality, integrity, and availability of data and services.

Recommendation

Immediately update WMPro to the latest version if available, and restrict access to the application to trusted users only.

Original NVD description (English source)

WMPro developed by Sunnet has a Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.