CSRF Vulnerability in Pluck CMS Admin Panel

CVE-2026-70376

What is CVE-2026-70376?

Pluck CMS's admin panel is susceptible to a Cross-Site Request Forgery (CSRF) vulnerability due to its reliance on Referer header comparison without implementing a per-request anti-CSRF token. This weakness allows an attacker to create malicious requests by suppressing the Referer header, which can lead to unauthorized actions performed by authenticated administrators. These actions include potentially dangerous operations, such as injecting raw HTML that could result in stored cross-site scripting (XSS) or installing unauthorized PHP modules or themes, leading to remote code execution. It is essential for users of Pluck CMS to implement necessary security measures and apply updates to mitigate this risk.

References