CVE-2026-30460

CVE-2026-30460 is an authenticated remote code execution vulnerability discovered in Daylight Studio FuelCMS version 1.5.2, specifically within the Blocks module. This flaw allows authenticated users to execute arbitrary code on affected systems, representing a significant post-authentication security risk. The vulnerability carries a CVSS score of 8.8 (HIGH) with a network-based attack vector, low complexity, and no user interaction required. It provides attackers with high-impact consequences across confidentiality, integrity, and availability, though exploitation requires valid authentication credentials to the application. Exploitation appears limited at present, with no active entries on the KEV catalog and low community attention as indicated by the low EPSS score of 0.00123. No public exploit code appears to be widely circulating, and the vulnerability currently holds an inactive status on threat tracking lists, suggesting minimal real-world exploitation activity to date.