# CVE-2025-13786: taosir WTCMS code injection in fetch function

Source: https://junglewise.ai/threats/cve-2025-13786-taosir-wtcms-code-injection-in-fetch-function  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-11-30. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2025-13786 · Severity: high · CVSS 7.3 · Published 2025-11-30

WTCMS is a content management system used to build and manage websites. An unauthenticated attacker can inject arbitrary PHP code through a parameter in the fetch function, allowing them to execute arbitrary commands on the server and take complete control of the website, including accessing or modifying all hosted data.

Technologies: [Wtcms Project Wtcms](https://junglewise.ai/threats/technologies/wtcms). Vendors: [Wtcms Project](https://junglewise.ai/threats/vendors/wtcms-project).

## Quick answers

**Is CVE-2025-13786 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-13786 being exploited in the wild.

**How severe is CVE-2025-13786?** High severity, with a CVSS score of 7.3, published 30 November 2025.

**Which products and versions are affected?** taosir WTCMS up to 01a5f68a3dfc2fdddb44eed967bb2d4f60487665.

**Is there a fix for CVE-2025-13786?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-13786 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2025-13786?** Check whether you run Wtcms Project Wtcms. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a code injection flaw in the fetch function of WTCMS's index.php endpoint. An attacker can manipulate the "content" parameter in a GET request to inject arbitrary PHP code without authentication. The injected code is executed server-side, allowing an attacker to write files, execute system commands, and achieve remote code execution. The attack requires only network access to the vulnerable endpoint and no authentication is necessary. A public proof-of-concept exploit exists that writes a PHP file to the server and executes arbitrary system commands. The vendor was contacted but did not respond, and no patch has been released.

## Affected products

- taosir WTCMS up to 01a5f68a3dfc2fdddb44eed967bb2d4f60487665

## Timeline

- 2025-11-30: disclosed
- other: Public exploit available

## References

- [https://github.com/TiKi-r/CVE-Report/blob/main/WtcmsRCE.md](https://github.com/TiKi-r/CVE-Report/blob/main/WtcmsRCE.md)
- [https://github.com/TiKi-r/CVE-Report/blob/main/WtcmsRCE.md](https://github.com/TiKi-r/CVE-Report/blob/main/WtcmsRCE.md)

## Related threats

- [A security flaw has been discovered in taosir WTCMS up to 01a5f68a3dfc2fdddb44eed967bb2d4f60487665. This affects the…](https://junglewise.ai/threats/cve-2025-13783-a-security-flaw-has-been-discovered-in-taosir-wtcms-up-to)
- [A vulnerability was identified in taosir WTCMS up to 01a5f68a3dfc2fdddb44eed967bb2d4f60487665. Affected by this issue…](https://junglewise.ai/threats/cve-2025-13782-a-vulnerability-was-identified-in-taosir-wtcms-up-to)