MetInfo CMS CVE-2026-29014 Exploited for Remote Code Execution Attacks
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-29014 | Unauthenticated PHP Code Injection RCE in MetInfo CMS CVE-2026-29014 is an unauthenticated PHP code injection flaw (CWE-94) in MetInfo CMS, caused by insufficient neutralization of user-supplied input in an execution path that evaluates PHP. A remote attacker needs no privileges or user interaction and triggers the flaw simply by sending crafted requests containing malicious PHP, which the server then executes. Successful exploitation results in full remote code execution, giving the attacker complete control over the affected web server and everything it hosts. All MetInfo CMS 7.9, 8.0, and 8.1 deployments are affected, with risk concentrated in internet-facing installations. Exploitation has been reported in the wild, public PoCs are available, and the 39.5% EPSS score (99th percentile) signals high near-term exploitation risk, though the flaw is not yet listed in CISA KEV. Do: Upgrade MetInfo CMS to the latest patched release; the advisory flags 7.9, 8.0, and 8.1 as affected, so confirm the exact fixed version in the vendor's advisory before upgrading, and prioritize internet-facing instances. Until patched, restrict or WAF-filter HTTP access to MetInfo endpoints and review access logs for crafted requests containing injected PHP syntax. Use the public PoC write-ups (Karmain Security KIS-2026-06 and WebSec) to identify the vulnerable request pattern when hunting for signs of compromise. | 9.3 | 39% | PoC ×2 |
| largeon the order of 100,000+ deployments (order-of-magnitude estimate; no authoritative install count published) |
Full article316 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananMay 05, 2026Vulnerability / Network Security
Threat actors are actively exploiting a critical security flaw impacting an open-source content management system (CMS) known as MetInfo, according to new findings from VulnCheck.
The vulnerability in question is CVE-2026-29014 (CVSS score: 9.8), a code injection flaw that could result in arbitrary code execution.
"MetInfo CMS versions 7.9, 8.0, and 8.1 contain an unauthenticated PHP code injection vulnerability that allows remote attackers to execute arbitrary code by sending crafted requests with malicious PHP code," the NIST National Vulnerability Database (NVD) states.
"Attackers can exploit insufficient input neutralization in the execution path to achieve remote code execution and gain full control over the affected server."
Per security researcher Egidio Romano, who discovered the vulnerability, the problem is rooted in the "/app/system/weixin/include/class/weixinreply.class.php" script, and stems from a lack of adequate sanitization of user-supplied input when issuing Weixin (aka WeChat) API requests.
As a result, remote, unauthenticated attackers could exploit this loophole to inject and execute arbitrary PHP code. One key prerequisite for successful exploitation when MetInfo is running on non-Windows servers is that the "/cache/weixin/" directory has to exist beforehand.The directory is created when installing and configuring the official WeChat plugin.
Patches for CVE-2026-29014 were released by MetInfo on April 7, 2026. The vulnerability has since come under exploitation as of April 25, with a "small number of exploits" deployed against susceptible honeypots located in the U.S. and Singapore.
Although these efforts were initially sparse and associated with automated probing, the activity witnessed a surge on May 1, 2026, focusing on China and Hong Kong IP addresses, Caitlin Condon, vice president of security research at VulnCheck, said. As many as 2,000 instances of MetInfo CMS are accessible online, most of which are in China.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2026/05/metinfo-cms-cve-2026-29014-exploited.html