Is CVE-2026-32593 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-32593 being exploited in the wild.

How severe is CVE-2026-32593?

Medium severity, with a CVSS score of 5.9, published 26 August 2026.

Which products and versions are affected?

winter/wn-backend-module (Packagist) <= 1.2.12, ECOSYSTEM:introduced=0,fixed=1.2.13; Winter CMS <= 1.2.12.

Is there a fix for CVE-2026-32593?

Yes. winter/wn-backend-module (Packagist): upgrade to 1.2.13 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-32593 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-32593?

Check whether you run winter/wn-backend-module (Packagist) or Winter CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-32593: Winter CMS SQL injection in Backend Filter Widget numberrange scope

Q: Is there a fix for CVE-2026-32593?

Yes. winter/wn-backend-module (Packagist): upgrade to 1.2.13 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-32593 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-32593?

Check whether you run winter/wn-backend-module (Packagist) or Winter CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-32593 · Severity: medium · CVSS 5.9 · Published 2026-08-26

Winter CMS, a content management system, is vulnerable to a security flaw in its administrative interface. An authorized user with access to specific data filters could potentially execute unauthorized database commands. This could allow an attacker to view sensitive information stored in the database that they are not normally permitted to see. This issue primarily affects sites using third-party plugins that implement specific numeric range filters.

Technologies: winter/wn-backend-module (Packagist), Winter CMS. Vendors: Packagist, Winter CMS.

Quick answers

Is CVE-2026-32593 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-32593 being exploited in the wild.
How severe is CVE-2026-32593?: Medium severity, with a CVSS score of 5.9, published 26 August 2026.
Which products and versions are affected?: winter/wn-backend-module (Packagist) <= 1.2.12, ECOSYSTEM:introduced=0,fixed=1.2.13; Winter CMS <= 1.2.12.
Is there a fix for CVE-2026-32593?: Yes. winter/wn-backend-module (Packagist): upgrade to 1.2.13 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-32593 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-32593?: Check whether you run winter/wn-backend-module (Packagist) or Winter CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

winter/wn-backend-module (Packagist): upgrade to 1.2.13 or later
```
composer require winter/wn-backend-module:^1.2.13
```

Technical details

A SQL injection vulnerability exists in the Winter CMS Backend Filter widget (`Backend\Widgets\Filter`). The flaw is located in the `numberrange` scope type when it is configured using a `conditions` key, specifically within the `numbersFromAjax` handler. An authenticated attacker with access to a list view utilizing this specific filter configuration can inject arbitrary SQL commands. While vanilla installations do not use this specific configuration, third-party plugins may introduce the vulnerable scope. The issue has been patched in version 1.2.13 by improving input sanitization within the filter widget.

Affected products

Winter CMS Winter CMS <= 1.2.12

Identifiers

CVE-2026-32593
GHSA-m7jc-g4rc-jmvh

Timeline

2026-08-07: disclosed: Vulnerability reported to Winter CMS
2026-08-12: advisory: GitHub Advisory published
2026-08-12: patched: Fixed in Winter CMS v1.2.13

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.