ProcessWire vulnerabilities
4 known CVE vulnerabilities in ProcessWire, translated and rated.
- CVE-2026-40500Low risk· EPSS 31%
CVE-2026-40500 has been rejected by its CVE Numbering Authority. The reported SSRF vulnerability in the 'Add Module from URL' feature does not pose a real threat because it requires superuser privileges (root-equivalent in ProcessWire) who already has unrestricted arbitrary code execution via standard module upload. The feature is disabled by default and requires direct filesystem access to enable.
- CVE-2024-41597Medium
A Cross-Site Request Forgery (CSRF) vulnerability was found in ProcessWire version 3.0.229, allowing a remote attacker to insert a comment. The supplier disputes this, stating the product intentionally accepts anonymous, unauthenticated comments and that submitted comments are held for moderator review by default.
- CVE-2022-40488Medium
ProcessWire v3.0.200 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability. An attacker can exploit this flaw to perform unauthorized actions on behalf of an authenticated user.
- CVE-2022-40487Medium
ProcessWire v3.0.200 was found to have multiple XSS vulnerabilities in the Search Users and Search Pages functions. These flaws allow attackers to inject arbitrary JavaScript or HTML.