MetInfo CMS Code Injection RCE Exploitation | MSSP Advisory

Threat actors are actively exploiting CVE-2026-29014, a critical code injection vulnerability in MetInfo CMS versions 7.9, 8.0, and 8.1 that allows unauthenticated remote code execution with a CVSS score of 9.8. The flaw permits attackers to execute arbitrary PHP code without authentication, giving them complete control over affected websites. VulnCheck reports active exploitation in the wild targeting this open-source content management system.

Your clients running MetInfo CMS face immediate compromise with attackers gaining full server control to steal data, install backdoors, or pivot into internal networks. Any MSSP client using this relatively obscure CMS is sitting exposed right now, and if they get breached because you did not warn them about active exploitation, that becomes your retention and liability problem.