CVE-2026-12066: PbootCMS Weak Password Recovery RCE – CVSS 7.3 HIGH

Technical summary

CVE-2026-12066 is a weak password recovery vulnerability in PbootCMS affecting versions through 3.2.12. The flaw resides in the retrieve() function within apps/home/controller/MemberController.php. The password handler component fails to properly validate and sanitize the username, password, email, and checkcode parameters during the recovery process. This CWE-640 (Weak Password Recovery Mechanism) issue allows remote, unauthenticated attackers to manipulate recovery flows to compromise account security. The CVSS 3.1 score of 7.3 (HIGH) reflects the network-accessible nature, low complexity of exploitation, and impact across confidentiality, integrity, and availability.

Business impact

Compromised user accounts represent significant operational and reputational risk. If PbootCMS is deployed for customer-facing applications, content management, or e-commerce, successful exploitation could expose sensitive user data, enable unauthorized modifications to site content, and erode customer trust. Attackers can systematically recover or reset accounts belonging to high-value users, administrators, or employees. Organizations should assess whether user data subject to regulatory frameworks (GDPR, HIPAA, PCI-DSS) is managed through affected instances.

Affected systems

PbootCMS versions up to and including 3.2.12 are confirmed vulnerable. Organizations running PbootCMS in production should verify their installed version immediately. Web-accessible PbootCMS installations used for content management, community platforms, or any application handling user authentication are directly at risk.

Exploitability

This vulnerability is exploitable remotely without authentication, credentials, or user interaction. Public exploit code has been released, meaning threat actors have functional proof-of-concept tooling available. The attack vector is network-based with low complexity, making it likely to be rapidly weaponized by opportunistic threat actors scanning for vulnerable instances. Organizations should treat this as high-priority from an exploitability perspective.

Remediation

Upgrade PbootCMS to a patched version released after the 3.2.12 branch. Verify the specific version number against the official PbootCMS vendor advisory to ensure the patch addresses CVE-2026-12066. As an interim measure, implement authentication-layer controls: restrict access to password recovery endpoints by IP allowlist if feasible, monitor recovery request logs for anomalies, and enforce rate limiting on recovery submissions. Consider temporarily disabling self-service password recovery if operationally acceptable while patches are tested and deployed.

Patch guidance

Consult the official PbootCMS project repository or vendor security advisories to identify the first patched version that remedies CVE-2026-12066. Patch releases typically address the weak validation logic in the retrieve() function. Organizations should test patches in a non-production environment before rollout to confirm functionality and rule out conflicts with custom extensions. Establish a change window aligned with your business cycle for deployment.

Detection guidance

Monitor authentication and password recovery logs for suspicious patterns: multiple failed recovery attempts targeting the same or different accounts from the same IP, recovery requests with unusual parameter values, successful recovery of high-privilege accounts outside normal business hours, and anomalous resets of recently-accessed accounts. Implement Web Application Firewall (WAF) rules to inspect password recovery endpoint traffic for parameter tampering or encoding bypass attempts. Network-level detection can flag POST requests to the MemberController.php retrieve function with suspicious payloads or rapid-fire submissions.

Why prioritize this

This vulnerability warrants immediate attention. The combination of remote exploitability without authentication, publicly available exploit code, HIGH CVSS score, and direct impact on user account security creates urgent business risk. Unlike vulnerabilities requiring user interaction or specialized knowledge, this flaw can be exploited at scale by automated scanning and weaponized code. Organizations should prioritize patching or mitigation within their critical remediation window.

Risk score, explained

The CVSS 3.1 score of 7.3 reflects a HIGH-severity issue with significant real-world impact. The Attack Vector (Network) and Attack Complexity (Low) indicate broad, easy exploitability. Privileges Required (None) and User Interaction (None) eliminate typical friction that might delay attacks. The Confidentiality, Integrity, and Availability impacts are rated Low individually but collectively result in meaningful compromise of user account security. The score does not account for public exploit availability, which amplifies practical risk.

Frequently asked questions