Quick answers
- Is CVE-2026-53756 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-53756 being exploited in the wild.
- How severe is CVE-2026-53756?
- Medium severity, with a CVSS score of 4.9, published 4 September 2026.
- Which products and versions are affected?
- Emlog CMS Pro prior to 2.6.16.
- Is there a fix for CVE-2026-53756?
- A patch was published on 2026-06-04: version 2.6.16 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-53756 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-53756?
- Check whether you run Emlog CMS Pro at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a blind SQL injection (CWE-89) in the User_Model::getUserDataByLogin() method, where the $account parameter is directly interpolated into SQL queries without sanitization. The vulnerable code path is reached during auth cookie validation, where an attacker must forge a valid HMAC signature using the AUTH_KEY to inject malicious SQL into the $username variable. An authenticated attacker (or one with knowledge of AUTH_KEY) can perform time-based blind SQL injection to extract database contents. The vulnerability has been patched in version 2.6.16 by adding database input escaping as shown in commit 92b6eea.
Affected products
- Emlog CMS Pro prior to 2.6.16
Timeline
- 2026-09-04: disclosed
- 2026-06-04: patched: version 2.6.16 released with fix