CVE-2026-111687

WeRSS (we-mp-rss) through 1.5.3 contains a remote code execution vulnerability that allows unauthenticated attackers to run code via the template parameter of the public GET /rss/{feed_id} endpoint. Attackers can supply a non-built-in ext value and a {{=expression}} template whose object-subclass traversal bypasses the eval denylist to run OS commands as the service account.

The flaw enables unauthenticated attackers to execute arbitrary code remotely, potentially leading to full host takeover and data compromise. The risk is critical because the endpoint is public.

Update WeRSS to a patched version as soon as possible or disable the public /rss/{feed_id} endpoint. Also restrict service account privileges and monitor for unusual commands.