CVE-2026-53952
CriticalCVSS 9.8Summary
GetSimple CMS (v3.4.0a and below) and GetSimple CMS CE (v3.3.22 and below) contain a logic flaw allowing unauthenticated attackers to create a new administrator account. The automated control that deletes admin/setup.php after installation is neutralized by a self-exclusion bug, leaving the setup script accessible. As of publication, no patched versions are available.
Risk Assessment
Anyone can remotely create an administrator account on an unpatched GetSimple CMS installation, leading to full site takeover.
Recommendation
Manually remove or block access to admin/setup.php after installation and consider migrating to an actively maintained CMS, as no official patch exists.
Other vulnerabilities in GetSimple CMS
See all- CVE-2017-8081High
Poor cryptographic salt initialization in admin/inc/template_functions.php in GetSimple CMS 3.3.13 allows a network attacker to escalate privileges to an arbitrary user or conduct CSRF attacks via calculation of a session cookie or CSRF nonce.
- CVE-2014-8722High
GetSimple CMS version 3.3.4 allows remote attackers to obtain sensitive information via direct requests to specific XML files.
Original NVD description (English source)
GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. A logic flaw in GetSimple CMS (v3.4.0a and below) and GetSimpleCMS-CE (v3.3.22 and below) allows unauthenticated attackers to create a new administrator account. The application features an automated security control designed to delete the sensitive `admin/setup.php` file post-installation. However, this control is neutralized by a self-exclusion bug within the deletion logic, leaving the setup script accessible for unauthorized account creation even after a legitimate installation is completed. As of time of publication, no known patched versions are available.