CVE-2026-27741
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
Bludit 3.16.1 has a CSRF vulnerability in the /admin/uninstall-plugin/ and /admin/install-theme/ endpoints. Lack of CSRF tokens or request origin validation allows an attacker to trick an authenticated admin into performing unauthorized actions.
Risk Assessment
Risk includes unauthorized plugin uninstallation or malicious theme installation, potentially leading to loss of functionality, execution of untrusted code, and system integrity compromise.
Recommendation
Immediately update Bludit to the latest version and implement CSRF protections (tokens, Origin/Referer validation) for all sensitive admin endpoints.
Other vulnerabilities in Bludit
See all- CVE-2026-72576Medium
A stored cross-site scripting (XSS) vulnerability in Bludit 4.0.0-beta allows a low-privileged authenticated user (Author role) to inject arbitrary JavaScript by uploading a crafted SVG file as the site logo.
- CVE-2026-46657High
Bludit prior to version 3.22.0 has a vulnerability in the user management logic that allows deactivated accounts to maintain access via persistent authentication tokens. When an administrator disables a user account, the application fails to invalidate or clear the associated tokenAuth and tokenRemember fields in the JSON database. Consequently, any user with a pre-existing "Remember Me" cookie can bypass the account disablement and maintain a valid authenticated state.
- CVE-2026-46656High
Bludit prior to version 3.22.0 has a Broken Access Control flaw where active sessions remain valid even after the user account is deleted from the database. This allows revoked users to maintain unauthorized access.
- CVE-2026-27742Medium
Bludit 3.16.2 contains a stored XSS vulnerability in the post content functionality. The application performs client-side sanitation but lacks server-side enforcement. An authenticated user can inject arbitrary JavaScript into post content, which is stored and rendered to other users without proper output encoding.
- CVE-2020-19228High
An issue was found in Bludit v3.13.0 where an unsafe implementation of the backup plugin allows attackers to upload arbitrary files to the server.
Original NVD description (English source)
Bludit version 3.16.1 contains a cross-site request forgery (CSRF) vulnerability in the /admin/uninstall-plugin/ and /admin/install-theme/ endpoints. The application does not implement anti-CSRF tokens or other request origin validation mechanisms for these administrative actions. An attacker can induce an authenticated administrator to visit a malicious page that silently submits crafted requests, resulting in unauthorized plugin uninstallation or theme installation. This may lead to loss of functionality, execution of untrusted code via malicious themes, and compromise of system integrity.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS