What is CVE-2026-28495?

CVE-2026-28495 is a critical-severity vulnerability in Getsimplecms-ce, classified under Cross-Site Request Forgery (CSRF). CVSS score: 9.7/10. Published 2026-03-10.

How severe is CVE-2026-28495?

Critical severity. CVSS v3 base score is 9.7 out of 10.

CSRF in Getsimplecms-ce

CVE-2026-28495

GetSimple CMS is a content management system. The massiveAdmin plugin (v6.0.3) bundled with GetSimpleCMS-CE v3.3.22 allows an authenticated administrator to overwrite the gsconfig.php configuration file with arbitrary PHP code via the gsco…

Vulnerability class: CSRF (Cross-Site Request Forgery)

EPSS: 0.001 (29.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.7 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H.

Affected products

Getsimplecms-ce — versions <= 3.3.22

Weakness classification (CWE)

CWE-352 — Cross-Site Request Forgery (CSRF)

References

https://github.com/GetSimpleCMS-CE/GetSimpleCMS-CE/security/advisories/GHSA-92wv-q2jp-qg88 (x_refsource_CONFIRM)

Frequently asked questions

What is CVE-2026-28495?: CVE-2026-28495 is a critical-severity vulnerability in Getsimplecms-ce, classified under Cross-Site Request Forgery (CSRF). CVSS score: 9.7/10. Published 2026-03-10.
How severe is CVE-2026-28495?: Critical severity. CVSS v3 base score is 9.7 out of 10.