A critical vulnerability in GetSimple CMS and GetSimpleCMS-CE allows unauthenticated remote attackers to gain full administrative control over affected installations.

The application fails to properly delete the sensitive admin/setup.php file post-installation due to a logic error, allowing unauthenticated users to access the installation routine and create new administrative accounts.

This vulnerability carries a CVSS score of 9.8, indicating a critical severity level. Successful exploitation grants an attacker full administrative privileges, leading to complete system compromise, unauthorized data access, and potential exfiltration of sensitive content. The ability for an unauthenticated user to assume control poses a severe risk to organizational data integrity and operational continuity.

Immediate Action: As no official patch is currently available, administrators must manually delete the admin/setup.php file from their web server root directory to prevent unauthorized access.

Proactive Monitoring: Review web server access logs for any requests targeting admin/setup.php or unexpected account creation events within the CMS user management dashboard.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block all external access to the admin/setup.php file until an official fix is released.

Public Exploit Available: No

Given the critical nature of this flaw and the lack of an official patch, manual intervention is required immediately. Administrators should verify the presence of the setup script on their servers and remove it to neutralize the attack vector. Monitor the official GitHub security advisory for updates regarding a formal release that addresses the underlying deletion logic bug.