← Database

CVE-2026-70376

CRITICAL CVSS: 9.6 Published: 2026-08-05 Modified: 2026-08-10

Description

Pluck CMS's admin panel relies solely on a Referer-header comparison (requestedByTheSameDomain in data/inc/functions.admin.php, gating every admin.php action) for CSRF protection, with no per-request anti-CSRF token anywhere in the admin area.

Affected Platforms

Unknown

Weakness Type

CWE-352

References