A flaw in Concrete5 CMS could have allowed website takeover