CVE-2025-15226

Critical · 9.8

CVSS

9.8

EPSS

0.6%

Published

Dec 29, 2025

CISA due date

—

The record

WMPro developed by Sunnet has a Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.

Affected packages

Ecosystem	Package	Introduced	Fixed