CVE-2026-70376: Pluck CMS Admin Panel CSRF Vulnerability

CVE-2026-70376 Overview

CVE-2026-70376 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] in Pluck CMS. The admin panel relies solely on a Referer header comparison implemented in requestedByTheSameDomain() within data/inc/functions.admin.php to gate every admin.php action. The function contains no per-request anti-CSRF token. When a request arrives without Referer or Host information, an elseif branch returns true, treating the request as same-origin. Attackers can suppress the Referer header from a cross-site page and force an authenticated administrator's browser to submit forged admin actions, including page creation with raw HTML (stored XSS) and installation of PHP modules or themes (remote code execution).

Critical Impact
Successful exploitation grants an attacker full administrative control of the Pluck CMS instance, including arbitrary PHP code execution through module or theme installation.

Affected Products

Pluck CMS (admin panel component)
data/inc/functions.admin.php containing requestedByTheSameDomain()
All admin.php actions gated by the flawed same-origin check

Discovery Timeline

2026-08-05 - CVE-2026-70376 published to the National Vulnerability Database
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-70376

Vulnerability Analysis

Pluck CMS enforces CSRF protection on administrative actions through a single function, requestedByTheSameDomain(), defined in data/inc/functions.admin.php. The function compares the HTTP Referer header against the expected host. No anti-CSRF token is generated, embedded in admin forms, or validated on submission. This design places the full security boundary on a header that browsers may omit or that attackers can influence from a cross-origin context.

The function contains an elseif branch that returns true when neither Referer nor Host information is present in the request. A missing Referer is therefore interpreted as a legitimate same-origin request. An attacker-controlled page can instruct the browser to strip the Referer using <meta name="referrer" content="no-referrer"> or the referrerpolicy attribute on form elements, satisfying the check without originating from the same domain.

Root Cause

The root cause is reliance on Referer header inspection as the sole CSRF defense, combined with a fail-open code path that treats a missing Referer as trusted. Standard mitigation requires a per-session, per-request synchronizer token bound to the user's authenticated session, which Pluck CMS does not implement in the admin area.

Attack Vector

Exploitation requires an authenticated Pluck CMS administrator to visit an attacker-controlled page while their admin session is active. The malicious page sets a no-referrer policy and auto-submits a forged POST to admin.php targeting a sensitive action. Two impact chains are notable: creating a page with raw HTML injects stored XSS into the rendered site, and installing an attacker-supplied module or theme delivers PHP code execution on the server. The vulnerability requires user interaction from the administrator but no privileges from the attacker.

No verified proof-of-concept code has been published. See the Pluck CMS GitHub repository for source-level context on the affected function.

Detection Methods for CVE-2026-70376

Indicators of Compromise

Requests to admin.php with a missing or empty Referer header from authenticated administrator sessions
Unexpected new pages containing raw <script> or event-handler HTML in Pluck content storage
New or modified files under the data/modules/ or data/themes/ directories that were not deployed by an administrator
PHP files with recent modification timestamps inside module or theme directories that contain eval, system, exec, or base64_decode calls

Detection Strategies

Enable web server access logging with full Referer capture and alert on POST requests to admin.php where the header is absent
Monitor filesystem integrity for data/modules/ and data/themes/ directories and flag additions outside of maintenance windows
Inspect stored page content for unsanitized script tags introduced by non-interactive submissions

Monitoring Recommendations

Correlate administrator authentication events with subsequent admin.php POSTs originating from external Referers or lacking Referers
Track process execution from the PHP interpreter that spawns shells, network utilities, or persistence binaries
Retain web logs long enough to reconstruct the full CSRF chain, including the initial cross-site page load

How to Mitigate CVE-2026-70376

Immediate Actions Required

Restrict administrative access to admin.php by source IP using web server or firewall rules until a patched release is deployed
Require administrators to log out of the Pluck CMS admin panel when not actively performing maintenance
Disable module and theme installation functionality if it is not required in the current environment
Review recently created pages and installed modules or themes for unauthorized content

Patch Information

No vendor advisory URL is available in the CVE record at publication time. Monitor the Pluck CMS GitHub repository for a release that introduces per-request anti-CSRF tokens in admin.php handlers and removes the fail-open branch in requestedByTheSameDomain().

Workarounds

Deploy a reverse proxy or web application firewall rule that blocks POST requests to admin.php when the Referer header is missing or does not match the site host
Set the SameSite=Strict attribute on the Pluck CMS session cookie to prevent the browser from sending it with cross-site requests
Segment the administrative interface behind VPN or HTTP basic authentication to prevent authenticated CSRF from an arbitrary origin

bash

# Example Nginx rule enforcing Referer on admin POSTs
location = /admin.php {
    if ($request_method = POST) {
        set $csrf_ok 0;
        if ($http_referer ~* "^https?://your-site\.example/") { set $csrf_ok 1; }
        if ($csrf_ok = 0) { return 403; }
    }
    include fastcgi_params;
    fastcgi_pass unix:/run/php/php-fpm.sock;
}