CVE-2026-70376

Received Received - Intake

CSRF Bypass Leading to XSS and RCE in Pluck CMS

Publication date: 2026-08-05

Last updated on: 2026-08-10

Assigner: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Description

Pluck CMS's admin panel relies solely on a Referer-header comparison (requestedByTheSameDomain in data/inc/functions.admin.php, gating every admin.php action) for CSRF protection, with no per-request anti-CSRF token anywhere in the admin area.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-05

Last Modified

2026-08-10

Generated

2026-08-16

AI Q&A

2026-08-05

EPSS Evaluated

2026-08-15

NVD

CVE-2026-70376

EUVD

EUVD-2026-53196

Affected Vendors & Products

Vendor	Product	Version / Range
pluck_cms	pluck_cms	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-352	The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This vulnerability is a Cross-Site Request Forgery (CSRF) flaw in Pluck CMS's admin panel. The admin panel only checks the Referer header to verify if a request is legitimate. If the Referer header is missing or suppressed, the system incorrectly assumes the request is safe and allows actions like creating pages with raw HTML or installing PHP modules.

Detection Guidance

Check for missing Referer headers in admin panel requests. Inspect network traffic for admin.php actions without Referer or Host headers. Review Pluck CMS admin logs for unexpected page creations or PHP module installations.

Impact Analysis

An attacker could trick an authenticated admin into submitting malicious requests without their knowledge. This could lead to stored Cross-Site Scripting (XSS) attacks or remote code execution (RCE) on the server, compromising the entire system and data.

Compliance Impact

This vulnerability could lead to unauthorized access, data breaches, or code execution, violating GDPR's integrity and confidentiality requirements and HIPAA's security rules for protected health information.

Mitigation Strategies

Upgrade Pluck CMS to the latest version if available. Implement server-side CSRF tokens for all admin actions. Configure web server to enforce Referer headers for admin.php requests. Disable meta referrer policies that suppress Referer headers.

Hi! I’m here to help you understand CVE-2026-70376. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70