CVE-2025-67504

CVE-2025-67504 is a critical vulnerability affecting WBCE CMS versions 1.6.4 and below, stemming from its use of PHP's cryptographically insecure rand() function for password generation. This weakness allows attackers to predict or brute-force passwords, potentially leading to user account compromise or privilege escalation. With a CVSS score of 9.8 (CRITICAL), the vulnerability is easily exploitable over the network with low attack complexity, posing a high risk to confidentiality, integrity, and availability. While there is no evidence of active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered significant community discussion, indicating awareness among security researchers. Organizations using affected versions should upgrade to WBCE CMS 1.6.5 or higher immediately.