CVE-2026-53760

Name of the Vulnerable Software and Affected Versions Admidio versions prior to 5.0.11

Description The 'modules/plugins.php' endpoint handles plugin installation, uninstallation, and update operations via GET requests without CSRF (Cross-Site Request Forgery) token validation. CSRF is a type of attack that tricks a victim into submitting a malicious request. Because these operations are top-level navigations, browsers include SameSite=Lax session cookies, allowing an attacker to craft a malicious page that triggers arbitrary plugin operations when visited by an authenticated administrator. Specifically, the doUninstall() function executes SQL scripts containing DROP TABLE statements, which can lead to irreversible data loss. The vulnerable parameters are mode and name.

Recommendations Update to version 5.0.11 or later. As a temporary workaround, restrict access to the 'modules/plugins.php' endpoint to trusted networks only.