CVE-2026-70376

Name of the Vulnerable Software and Affected Versions Pluck CMS (affected versions not specified)

Description The admin panel lacks per-request anti-CSRF tokens and relies exclusively on a Referer-header comparison within the requestedByTheSameDomain() function located in data/inc/functions.admin.php to protect admin.php actions. If a request is submitted without Referer or Host information, the system incorrectly treats it as a same-origin request. An attacker can bypass this check by suppressing the Referer header, allowing them to force an authenticated administrator to perform unauthorized actions. This can lead to stored Cross-Site Scripting (XSS) through the creation of pages containing raw HTML or Remote Code Execution (RCE) via the installation of malicious PHP modules and themes.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.