CVE-2026-70376
CriticalCVSS 9.6Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
Pluck CMS's admin panel relies solely on a Referer-header comparison for CSRF protection, with no per-request anti-CSRF token. This allows attackers to potentially perform unauthorized admin actions if they can bypass the Referer check.
Risk Assessment
Risk of admin account takeover and unauthorized changes to the CMS, potentially leading to data integrity compromise and further attacks.
Recommendation
Implement per-request anti-CSRF tokens in the admin panel and update to a patched version.
Other vulnerabilities in Pluck CMS
See all- CVE-2014-8708Critical
Pluck CMS version 4.7.2 allows remote attackers to execute arbitrary code via the blog form feature.
- CVE-2026-54416High
Pluck CMS through 4.7.21 restricts dangerous file uploads in its admin file-management feature using a fixed blacklist in data/inc/files.php, checked against the last 4-5 characters of the filename.
- CVE-2026-16205Low
A cross-site scripting vulnerability has been found in Pluck CMS up to version 4.7.21 in the Albums module. The htmlspecialchars_decode function in data/modules/albums/albums.admin.php mishandles the Info argument, allowing remote injection of malicious scripts. The exploit is public, and the project has not responded to the report.
- CVE-2025-46099High
In Pluck CMS 4.7.20-dev, an authenticated attacker can upload or create a crafted PHP file under the albums module directory and access it via the module routing logic in albums.site.php, resulting in arbitrary command execution through a GET parameter.
Original NVD description (English source)
Pluck CMS's admin panel relies solely on a Referer-header comparison (requestedByTheSameDomain in data/inc/functions.admin.php, gating every admin.php action) for CSRF protection, with no per-request anti-CSRF token anywhere in the admin area.