What’s Vulnerable › Vulnerabilities

CVE-2025-67504: WBCE CMS has Weak Random Number Generator in Password Generation Function

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-12-09 · updated 2026-10-07
• Weakness: CWE-331

Description

WBCE CMS is a content management system. Versions 1.6.4 and below use function GenerateRandomPassword() to create passwords using PHP's rand(). rand() is not cryptographically secure, which allows password sequences to be predicted or brute-forced. This can lead to user account compromise or privilege escalation if these passwords are used for new accounts or password resets. The vulnerability is fixed in version 1.6.5.

Affected products

• WBCE CMS: before 1.6.5 — fixed in 1.6.5

How to fix

Upgrade to a fixed version: WBCE CMS 1.6.5. Check the vendor advisory for mitigations.

References

• https://cwe.mitre.org/data/definitions/338.html
• https://github.com/WBCE/WBCE_CMS/commit/5d59fe021a5c6e469b1bf192b72ca652e54278f6
• https://github.com/WBCE/WBCE_CMS/releases/tag/1.6.5
• https://github.com/WBCE/WBCE_CMS/security/advisories/GHSA-76gj-pmvx-jcc6
• https://github.com/WBCE/WBCE_CMS/security/advisories/GHSA-76gj-pmvx-jcc6

Get alerted when CVE-2025-67504 or the next vulnerability affects your stack