Loading story…
A public advisory disclosed CVE-2026-29014, an unauthenticated PHP code injection vulnerability in MetInfo CMS versions 7.9, 8.0, and 8.1. The flaw affects weixinreply.class.php, specifically the weixinreply::wxAdminLogin() method, where attacker-controlled EventKey and FromUserName XML fields are insufficiently sanitized before being passed to cache handling functions. The issue allows path traversal and arbitrary cache file inclusion, enabling attackers to write malicious PHP into /cache/weixin/Array.php and achieve remote code execution.
The vulnerability was discovered by Egidio Romano and was publicly disclosed after the vendor reportedly did not respond to multiple contact attempts. Exploitation on non-Windows systems requires the /cache/weixin/ directory to exist, a condition typically met when the official WeChat plugin is installed and configured. One advisory said no official patch was available at disclosure, while a later vendor update indicated a fix was released on 2026-04-07.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
MetInfo patched CVE-2026-29014 on 2026-04-07. The fix addressed the unauthenticated PHP code execution flaw affecting MetInfo CMS 7.9, 8.0, and 8.1.
The vulnerability was publicly disclosed on 2026-04-01 after the vendor reportedly did not respond to multiple disclosure attempts. Advisories described path traversal and arbitrary cache file inclusion leading to unauthenticated RCE, and noted that no official patch was available at disclosure time.
A PHP code injection vulnerability in MetInfo CMS versions 7.9, 8.0, and 8.1 was identified in the weixinreply.class.php component, allowing unauthenticated remote code execution under certain conditions. The issue was later assigned CVE-2026-29014.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
seclists.org
Open sourcekarmainsecurity.com
Open sourcekarmainsecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors are actively exploiting **CVE-2026-29014**, a critical `CVSS 9.8` vulnerability in the open-source **MetInfo CMS** that allows unauthenticated remote code execution through PHP code injection. The flaw affects MetInfo versions **7.9, 8.0, and 8.1** and stems from insufficient sanitization in Weixin/WeChat API requests handled by `weixinreply.class.php`, located under `/app/system/weixin/include/class/`. Successful exploitation can let attackers execute arbitrary code and potentially take full control of vulnerable servers. MetInfo issued patches on **April 7, 2026**, but exploitation was observed by **April 25** against honeypots in the United States and Singapore, before surging on **May 1** with attacks concentrated on China and Hong Kong. Exploitation depends on the presence of the `/cache/weixin/` directory, which is commonly created when the WeChat plugin is installed. Researchers said roughly **2,000** MetInfo CMS instances were reachable online, with the majority exposed in China.
Jun 29, 2026
A critical vulnerability in the WordPress **W3 Total Cache** plugin allows remote, unauthenticated attackers to execute arbitrary PHP commands on affected sites. Tracked as **`CVE-2025-9501`**, the flaw affects versions earlier than **`2.8.13`** and is tied to insufficient validation of user input in the plugin’s **`_parse_dynamic_mfunc()`** function. According to CSIRT.SK, the bug can be triggered through a specially crafted comment, creating a path to full system compromise on vulnerable WordPress installations. The issue carries a **CVSS v3 score of 9.0**, underscoring the risk to organizations running the plugin in production. Security updates were released by the vendor in **W3 Total Cache 2.8.13**, and defenders are being urged to upgrade immediately and review WordPress databases, site files, and logs for evidence of exploitation or malicious post-compromise activity.
Jul 24, 2026
A high-severity vulnerability tracked as **CVE-2026-66398** affects **phpMyFAQ** versions before **4.1.6**, allowing authenticated remote code execution through the application's configuration API. The flaw requires an administrator account with the `CONFIGURATION_EDIT` and `ATTACHMENT_ADD` privileges, and stems from unsafe handling of the `upgrade.lastDownloadedPackage` setting during the update process. An attacker can exploit the issue by uploading a malicious ZIP archive as an attachment, repointing the updater configuration to that stored file path, and triggering extraction into the application root so arbitrary PHP files are written and executed. Successful exploitation yields code execution as the web server user, with reported impact spanning confidentiality, integrity, and availability; **phpMyFAQ 4.1.6** is listed as unaffected.
Jul 28, 2026