Arbitrary File Upload Vulnerability in WMPro by Sunnet
CVE-2025-15226

9.3CRITICAL

Key Information:

Vendor

Sunnet

Status
Wmpro
Vendor
CVE Published:
29 December 2025

What is CVE-2025-15226?

The WMPro application developed by Sunnet contains a serious security flaw that allows unauthenticated attackers to upload files to the server. This vulnerability can be exploited to introduce web shell backdoors, leading to unauthorized execution of arbitrary code on the server. This potential for remote code execution poses a significant risk to systems using affected versions of WMPro, making it crucial for users to apply security updates immediately.

Affected Version(s)

WMPro 5.0 <= 5.2

References

https://www.twcert.org.tw/tw/cp-132-10602-c1c69-1.html
third-party-advisory
https://www.twcert.org.tw/en/cp-139-10603-67149-2.html
third-party-advisory

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.