CVE-2026-70376

Summary

The flaw in Pluck CMS's admin panel allows attackers to perform cross-site request forgery (CSRF) attacks by manipulating the Referer header, leading to potential unauthorized actions.

Exploitability

Exploitation is relatively straightforward as it requires an attacker to craft a malicious request with the correct Referer header. The precondition is that the attacker must be able to trick a user into performing an action on the admin panel.

Blast radius

If exploited, this could result in unauthorized changes to the CMS, potentially leading to data loss, compromise of administrative functions, or other severe consequences.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Implement a per-request anti-CSRF token in the admin area, as described in the vendor advisory. Upgrade to the specific version 2.590 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.