CVE-2026-28495: GetSimple CMS is a content management system. The massiveAdmin plugin (v6.0.3) bundled with GetSimpleCMS-CE v3.3.22 allows an authenticated administrator to…

PriorityP356high8.8CVSS 3.1

AVNACLPRNUIRSUCHIHAH

EPSS

0.29%

21.1th percentile

GetSimple CMS is a content management system. The massiveAdmin plugin (v6.0.3) bundled with GetSimpleCMS-CE v3.3.22 allows an authenticated administrator to overwrite the gsconfig.php configuration file with arbitrary PHP code via the gsconfig editor module. The form lacks CSRF protection, enabling a remote unauthenticated attacker to exploit this via Cross-Site Request Forgery against a logged-in admin, achieving Remote Code Execution (RCE) on the web server.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
getsimple-ce	getsimple_cms	<= 3.3.22	—
getsimplecms-ce	getsimplecms-ce	<= 3.3.22	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.