CVE-2026-53952

GetSimple CMS and its community edition contain a logic flaw in the automated security control that is supposed to delete the installation script admin/setup.php once setup is complete: a self-exclusion bug in the deletion routine prevents the script from ever being removed. Because admin/setup.php remains reachable on fully installed sites, any unauthenticated remote attacker can invoke it and create a new administrator account (CWE-306/CWE-285/CWE-489). With administrator credentials established this way, an attacker gains full control of the CMS, including content manipulation and the typical admin-path paths to code execution. All GetSimple CMS versions 3.4.0a and below and GetSimpleCMS-CE versions 3.3.22 and below are affected, and no patched release was available at publication. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known as of the time of writing.

What to do: No fixed version is available yet, so manually delete admin/setup.php from every installation or block web access to it (e.g., via web server rules) immediately. Audit user accounts for administrator entries you did not create, and review access logs for requests to admin/setup.php that could indicate prior exploitation. Monitor the GetSimple CMS and GetSimpleCMS-CE projects for a patched release and upgrade as soon as one ships.