CVE-2026-70376

9.6 CRITICALpublic exploit available

Published 2026-08-05 · Updated 2026-08-10

AI risk analysis

Summary: The flaw allows attackers to perform CSRF attacks by manipulating the Referer header, bypassing admin panel protections.
Exploitability: Exploitation is relatively easy if an attacker can control the user's session and manipulate the Referer header.
Blast radius: If exploited, it could lead to full compromise of the admin area, including data theft or unauthorized actions.
Prioritized remediation: Implement per-request anti-CSRF tokens in the admin panel to replace the reliance on Referer headers.

csrfadminwebsecurity

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

Pluck CMS's admin panel relies solely on a Referer-header comparison (requestedByTheSameDomain in data/inc/functions.admin.php, gating every admin.php action) for CSRF protection, with no per-request anti-CSRF token anywhere in the admin area.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Weaknesses

CWE-352

Public exploit & PoC references

https://github.com/pluck-cms/pluck

All references

https://github.com/pluck-cms/pluck

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.