CVE-2026-94102 WuzhiCMS CVE debrief

Who should care

Defenders responsible for WuzhiCMS installations should assess the potential impact of this vulnerability on their users and prioritize verification and mitigation efforts. WuzhiCMS administrators should verify the presence of this vulnerability and implement measures to prevent open redirects. This includes reviewing the system's current configuration, identifying potential entry points for attackers, and ensuring that appropriate security controls are in

Why it matters

Defenders should care about CVE-2026-94102 because it allows remote attackers to redirect users to arbitrary URLs, potentially leading to phishing attacks or credential compromise. WuzhiCMS administrators should verify the presence of this vulnerability and implement measures to prevent open redirects.

• User redirection to malicious sites
• Potential phishing attacks via open redirects
• Increased risk of user credential compromise

Technical summary

The vulnerability is an open redirect issue in WuzhiCMS version 4.1.0 and earlier, located in the login functionality of the /index.php?m=member&v=Login file. This allows remote attackers to redirect users to arbitrary URLs. The exploit has been made public, and although the vendor was notified, no response was received. The sanitization in place is remove_xss(), an XSS keyword/entity scrubber. This vulnerability can be used to redirect users to malicious sites, potentially leading to phishing attacks or credential compromise.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their WuzhiCMS installations and assess the potential impact of open redirects on their users.

Recommended defensive actions

• Verify WuzhiCMS version and apply patches if available
• Implement additional security measures to prevent open redirects
• Monitor user interactions with the login functionality
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details about the vulnerability, including its CVSS score of 2.1 and severity of LOW. However, the vendor's response to the disclosure is unknown. Defenders should verify the presence of this vulnerability in their WuzhiCMS installations and assess the potential impact of open redirects on their users. The exploit has been made public, and although the vendor was notified, no response was received. The sanitization in place is remove_xss(), an XSS keyword/entity scrubber. This information is based

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.