# CVE-2026-53952: GetSimple CMS unauthenticated admin account creation via setup script

Source: https://junglewise.ai/threats/cve-2026-53952-getsimple-cms-unauthenticated-admin-account-creation-via-setup  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-11. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-53952 · Severity: critical · CVSS 9.8 · Published 2026-09-11

GetSimple CMS is a popular open-source content management system. A logic flaw in the setup script deletion logic leaves the installation script accessible even after the site is configured, allowing attackers without any authentication to create new administrator accounts and gain full control of the CMS. This can lead to complete website compromise, data theft, and malware installation.

Technologies: [GetSimple CMS CE](https://junglewise.ai/threats/technologies/getsimple-cms-ce). Vendors: [GetSimple](https://junglewise.ai/threats/vendors/getsimple).

## Quick answers

**Is CVE-2026-53952 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-53952 being exploited in the wild.

**How severe is CVE-2026-53952?** Critical severity, with a CVSS score of 9.8, published 11 September 2026.

**Which products and versions are affected?** GetSimple CMS CE 3.3.22 and below.

**Is there a fix for CVE-2026-53952?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-53952 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-53952?** Check whether you run GetSimple CMS CE at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an improper authorization and missing authentication issue in admin/setup.php. The root cause is a self-exclusion logic flaw in admin/inc/common.php (around line 285) where the file deletion logic skips cleanup whenever setup.php itself is being executed. Specifically, the condition `get_filename_id() != 'setup'` evaluates to false when setup.php is accessed, preventing the file from being deleted. Since setup.php lacks authentication checks and does not verify the existence of gsconfig.php before processing POST requests, any unauthenticated attacker can directly POST account creation data to /admin/setup.php and create a new XML-based administrator account. The attack requires only network access, no authentication, and no user interaction. Exploitation results in full administrative takeover and can be chained with theme editing features for remote code execution. No patched versions are currently available as of publication.

## Affected products

- GetSimple GetSimple CMS 3.4.0a and below
- GetSimple GetSimple CMS CE 3.3.22 and below

## Timeline

- 2026-09-11: disclosed: CVE published on NVD
- 2026-06-03: advisory: GitHub Security Advisory GHSA-rw2c-w4mg-46g4 published

## References

- [https://github.com/GetSimpleCMS-CE/GetSimpleCMS-CE/security/advisories/GHSA-rw2c-w4mg-46g4](https://github.com/GetSimpleCMS-CE/GetSimpleCMS-CE/security/advisories/GHSA-rw2c-w4mg-46g4)

## Related threats

- [GetSimple CMS stored XSS in backup viewer](https://junglewise.ai/threats/cve-2026-70650-getsimple-cms-is-a-content-management-system-cms-and-getsimple)
- [GetSimple CMS CE cross-site request forgery in UpdateCE](https://junglewise.ai/threats/cve-2026-56662-getsimple-cms-is-a-content-management-system-cms-and-getsimple)
- [GetSimple CMS server-side request forgery in update handler](https://junglewise.ai/threats/cve-2026-56661-getsimple-cms-is-a-content-management-system-cms-and-getsimple)
- [GetSimple CMS unrestricted ZIP extraction in UpdateCE plugin](https://junglewise.ai/threats/cve-2026-56660-getsimple-cms-is-a-content-management-system-cms-and-getsimple)
- [GetSimple CMS password reset authentication bypass](https://junglewise.ai/threats/cve-2026-53953-getsimple-cms-is-a-content-management-system-cms-and-getsimple)