pluck-cms Pluck CMS up to 4.7.20 functions.admin.php requestedByTheSameDomain cross-site request forgery

Summaryinfo

A vulnerability was found in pluck-cms Pluck CMS up to 4.7.20. It has been classified as problematic. Impacted is the function requestedByTheSameDomain of the file data/inc/functions.admin.php. This manipulation causes cross-site request forgery. This vulnerability appears as CVE-2026-70376. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability classified as problematic was found in pluck-cms Pluck CMS up to 4.7.20. Affected by this vulnerability is the function requestedByTheSameDomain of the file data/inc/functions.admin.php. The manipulation with an unknown input leads to a cross-site request forgery vulnerability. The CWE definition for the vulnerability is CWE-352. The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request. As an impact it is known to affect integrity. The summary by CVE is:

Pluck CMS's admin panel relies solely on a Referer-header comparison (requestedByTheSameDomain() in data/inc/functions.admin.php, gating every admin.php action) for CSRF protection, with no per-request anti-CSRF token anywhere in the admin area. When a request carries no Referer/Host information, the function's elseif branch returns true, treating the request as same-origin. Because a cross-site attacker page can suppress the Referer header (e.g. via <meta name=referrer content=no-referrer>), it can force an authenticated administrator's browser to submit forged admin actions with no valid Referer, including creating pages with raw HTML (stored XSS via the rendered page) and installing PHP modules/themes (remote code execution).

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-70376 since 08/04/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit.

By approaching the search of inurl:data/inc/functions.admin.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 4.7.21 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-53196). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Content Management System

Vendor

• pluck-cms

Name

• Pluck CMS

Version

• 4.7.0
• 4.7.1
• 4.7.2
• 4.7.3
• 4.7.4
• 4.7.5
• 4.7.6
• 4.7.7
• 4.7.8
• 4.7.9
• 4.7.10
• 4.7.11
• 4.7.12
• 4.7.13
• 4.7.14
• 4.7.15
• 4.7.16
• 4.7.17
• 4.7.18
• 4.7.19
• 4.7.20

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion