CVE-2026-70376
Received Received - Intake

CSRF Bypass Leading to XSS and RCE in Pluck CMS

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Description
Pluck CMS's admin panel relies solely on a Referer-header comparison (requestedByTheSameDomain() in data/inc/functions.admin.php, gating every admin.php action) for CSRF protection, with no per-request anti-CSRF token anywhere in the admin area. When a request carries no Referer/Host information, the function's elseif branch returns true, treating the request as same-origin. Because a cross-site attacker page can suppress the Referer header (e.g. via <meta name=referrer content=no-referrer>), it can force an authenticated administrator's browser to submit forged admin actions with no valid Referer, including creating pages with raw HTML (stored XSS via the rendered page) and installing PHP modules/themes (remote code execution).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-70376
EUVD
EUVD-2026-53196

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
pluck_cms pluck_cms *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Cross-Site Request Forgery (CSRF) flaw in Pluck CMS's admin panel. The admin panel only checks the Referer header to verify if a request is legitimate. If the Referer header is missing or suppressed, the system incorrectly assumes the request is safe and allows actions like creating pages with raw HTML or installing PHP modules.

Detection Guidance

Check for missing Referer headers in admin panel requests. Inspect network traffic for admin.php actions without Referer or Host headers. Review Pluck CMS admin logs for unexpected page creations or PHP module installations.

Impact Analysis

An attacker could trick an authenticated admin into submitting malicious requests without their knowledge. This could lead to stored Cross-Site Scripting (XSS) attacks or remote code execution (RCE) on the server, compromising the entire system and data.

Compliance Impact

This vulnerability could lead to unauthorized access, data breaches, or code execution, violating GDPR's integrity and confidentiality requirements and HIPAA's security rules for protected health information.

Mitigation Strategies

Upgrade Pluck CMS to the latest version if available. Implement server-side CSRF tokens for all admin actions. Configure web server to enforce Referer headers for admin.php requests. Disable meta referrer policies that suppress Referer headers.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-70376. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart