Quick answers
- Is CVE-2026-53953 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-53953 being exploited in the wild.
- How severe is CVE-2026-53953?
- Critical severity, with a CVSS score of 9.1, published 1 October 2026.
- Which products and versions are affected?
- GetSimple CMS CE 3.3.22.
- Is there a fix for CVE-2026-53953?
- No fixed version is recorded yet. Restrict access to the password reset endpoint at /admin/resetpassword.php by IP address or disable it until a patch is available. Implement rate limiting and account lockout on the admin login endpoint to prevent password guessing attacks. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-53953 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-53953?
- Check whether you run GetSimple CMS CE at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
Restrict access to the password reset endpoint at /admin/resetpassword.php by IP address or disable it until a patch is available. Implement rate limiting and account lockout on the admin login endpoint to prevent password guessing attacks.
Technical details
The password reset endpoint at /admin/resetpassword.php is accessible without authentication and generates temporary passwords using PHP rand() seeded with microtime(). The seed has a limited effective search space (0–999999), allowing an attacker to enumerate and test candidates against the admin login endpoint, which lacks rate limiting or account lockout. Successful exploitation grants unauthenticated admin access.
Affected products
- GetSimple CMS CE 3.3.22
Timeline
- 2026-06-11: disclosed
- 2026-10-01: advisory