Is CVE-2026-91848 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-91848 being exploited in the wild.

How severe is CVE-2026-91848?

High severity, with a CVSS score of 7.3, published 15 September 2026.

Is there a fix for CVE-2026-91848?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-91848 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-91848?

Check whether you run WuzhiCMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-91848: WuzhiCMS SQL injection in article::getDataOfJson

CVE-2026-91848 · Severity: high · CVSS 7.3 · Published 2026-09-15

WuzhiCMS is a PHP-based content management system used to build and manage websites. This vulnerability allows an unauthenticated attacker to execute arbitrary SQL queries against the underlying database by sending a specially crafted JSON POST request, potentially exposing all stored data including administrator credentials, user accounts, and sensitive business information.

Technologies: WuzhiCMS. Vendors: WuzhiCMS.

Quick answers

Is CVE-2026-91848 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-91848 being exploited in the wild.
How severe is CVE-2026-91848?: High severity, with a CVSS score of 7.3, published 15 September 2026.
Which products and versions are affected?: WuzhiCMS up to 4.1.0.
Is there a fix for CVE-2026-91848?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-91848 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-91848?: Check whether you run WuzhiCMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a SQL injection flaw in the article::getDataOfJson function within /index.php. The function reads JSON-formatted request data directly from php://input, extracting the "title" and "master_table" parameters without any sanitization or parameterized query protection. These values are then concatenated directly into SQL strings. Because the JSON input path bypasses the framework's standard sql_replace() filter chain that applies to GET/POST parameters, SQL metacharacters like single quotes and backticks reach the SQL engine unescaped. An unauthenticated attacker can exploit this via a POST request to /index.php?m=content&f=article&v=getDataOfJson with no login or special privileges required. The injection enables error-based, time-based blind, and UNION-based data extraction, allowing full database disclosure including password hashes and salts. No patch has been publicly released as of the advisory date.

Affected products

WuzhiCMS WuzhiCMS up to 4.1.0

Timeline

2026-09-15: disclosed: Public disclosure via GitHub issue #218 and NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.