CVE-2026-70376 Details
Description
Pluck CMS's admin panel relies solely on a Referer-header comparison (requestedByTheSameDomain in data/inc/functions.admin.php, gating every admin.php action) for CSRF protection, with no per-request anti-CSRF token anywhere in the admin area.
A Cross-Site Request Forgery (CSRF) vulnerability has been identified in Pluck CMS's admin panel. The issue arises because the admin panel relies solely on Referer-header comparisons for CSRF protection, without implementing per-request anti-CSRF tokens. When a request lacks Referer or Host information, the admin panel mistakenly treats it as same-origin, allowing cross-site attackers to forge admin actions. This exploitation can include creating pages with raw HTML that triggers stored Cross-Site Scripting (XSS) or installing PHP modules and themes, potentially leading to remote code execution.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 5, 2026CISA-ADP
Assessed Aug 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/pluck-cms/pluck | TuranSec | Source CodeVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-352 | Cross-Site Request Forgery (CSRF) | TuranSec |
Affected Products
| Product | Versions |
|---|---|
| Pluck CMS | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 10, 2026 | CVE Modified | TuranSec |
| Aug 5, 2026 | CVE Modified | CISA-ADP |
| Aug 5, 2026 | New CVE Received | TuranSec |