CVE-2026-70376 — Pluck CMS - CSRF via Spoofable Missing-Referer Bypass Leads to Stored XSS and RCE
Pluck CMS's admin panel relies solely on a Referer-header comparison (requestedByTheSameDomain in data/inc/functions.admin.php, gating every admin.php action) for CSRF protectio…
Published: 2026-08-05 · CVSS: 9.6 · CVSS 3.1
Pluck CMS's admin panel relies solely on a Referer-header comparison (requestedByTheSameDomain in data/inc/functions.admin.php, gating every admin.php action) for CSRF protection, with no per-request anti-CSRF token anywhere in the admin area.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7