CVE-2026-70376

CriticalCVSS 9.6

Published: 05/08/2026(UTC)Updated: 10/08/2026(UTC)Translated: 10/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.19%

9th percentile - higher than 9% of all known CVEs

Summary

Pluck CMS's admin panel relies solely on a Referer-header comparison for CSRF protection, with no per-request anti-CSRF token. This allows attackers to potentially perform unauthorized admin actions if they can bypass the Referer check.

Risk Assessment

Risk of admin account takeover and unauthorized changes to the CMS, potentially leading to data integrity compromise and further attacks.

Recommendation

Implement per-request anti-CSRF tokens in the admin panel and update to a patched version.

Original NVD description (English source)

Pluck CMS's admin panel relies solely on a Referer-header comparison (requestedByTheSameDomain in data/inc/functions.admin.php, gating every admin.php action) for CSRF protection, with no per-request anti-CSRF token anywhere in the admin area.