CVE-CVE-2026-70376
Severity
CRITICAL
CVSS Score
9.6
Description
Pluck CMS's admin panel relies solely on a Referer-header comparison (requestedByTheSameDomain in data/inc/functions.admin.php, gating every admin.php action) for CSRF protection, with no per-request anti-CSRF token anywhere in the admin area....
PoCs for CVE-CVE-2026-70376
PluckCMS-CSRF-RCE
RCE
Python
0
IlhomjonR
2026-08-12