CVE-2026-27198: Privilege Escalation in Formwork CMS

The impact of CVE-2026-27198 is significant. An attacker successfully exploiting this vulnerability can gain complete administrative access to the Formwork CMS instance. This allows them to modify content, install malicious plugins or themes, steal sensitive data stored within the CMS, and potentially pivot to other systems on the network. The flat-file architecture of Formwork means that data is stored in plain text, making it particularly vulnerable to data exfiltration if an attacker gains control. The ability to create admin accounts effectively bypasses all security controls intended to protect the CMS, leading to a complete compromise of the system.

1. Reserved2026-02-18
2. Published2026-02-21
3. Modified2026-02-24
4. EPSS updated2026-03-23

The primary mitigation for CVE-2026-27198 is to immediately upgrade Formwork CMS to version 2.3.4 or later. If upgrading is not immediately feasible, consider implementing stricter role-based access controls within the CMS, although this is not a complete solution. Review user accounts and permissions to identify any suspicious activity. Monitor CMS logs for unusual account creation attempts. While a WAF cannot directly prevent this vulnerability, it can help detect and block suspicious requests related to account creation. After upgrading, verify the fix by attempting to create a new user with administrative privileges using an editor account; the creation should be denied.