CVE-2026-32593 wintercms CVE debrief

Who should care

Winter CMS administrators and users with backend access, especially those using third-party plugins, should assess exposure and prioritize updates to version 1.2.13 or later. They should verify plugin configurations and monitor for suspicious database activity. Winter CMS administrators should also review compensating controls for exposed systems while remediation is scheduled and verified.

Why it matters

CVE-2026-32593 is a SQL injection vulnerability in Winter CMS versions up to 1.2.12, requiring verification of exposure and prompt updates.

• Potential database content disclosure
• Need to verify plugin configurations and Winter CMS versions
• Prioritize updates to version 1.2.13 or later
• Monitor for suspicious database activity

Technical summary

The vulnerability exists in the backend Filter widget's numberrange scope type when configured with a conditions key, allowing authenticated backend users to inject arbitrary SQL. No built-in Winter CMS backend views use this scope type and configuration combination. This allows an authenticated backend user to inject arbitrary SQL and read database contents. The scope's filter values are interpolated into the conditions statement without parameter binding, so a user with access to a list view whose filter uses this scope and configuration can supply crafted input through the filter's AJAX handler and read arbitrary database contents.

Defensive priority

Assess exposure if using Winter CMS with affected versions and third-party plugins; prioritize verification and updates.

Recommended defensive actions

• Assess if using Winter CMS version 1.2.12 or earlier with third-party plugins that register numberrange filter scopes
• Verify if plugins are using the vulnerable scope type and configuration
• Update Winter CMS to version 1.2.13 or later
• Monitor for suspicious database queries
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its impact, and the fixed version. The vulnerability exists in Winter CMS versions up to and including 1.2.12. Exploitation requires a third-party plugin to have registered a numberrange filter scope with a conditions key. No built-in Winter CMS backend views use this scope type and configuration combination. Assess exposure if using Winter CMS with affected versions and third-party plugins; prioritize verification and updates. Verify plugin configurations and Winter 1

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.