CVE-2026-70552

Name of the Vulnerable Software and Affected Versions MaxSite CMS versions prior to 109.6

Description An authentication bypass exists in the AJAX dispatcher. Unauthenticated attackers can access admin-gated endpoints by providing any X-Requested-With header and requesting a base64-encoded path that resolves to any *-ajax.php file within the codebase. This allows unauthorized access to privileged plugin endpoints, enabling the manipulation of poll states and vote counts, as well as the execution of dangerous operations performed by admin-only AJAX files across the plugin tree.

Recommendations Update MaxSite CMS to a version later than 109.5.