CVE-2026-70552: MaxSite CMS Auth Bypass Vulnerability

CVE-2026-70552 Overview

CVE-2026-70552 is an authentication bypass vulnerability affecting MaxSite CMS version 109.5 and earlier. The flaw resides in the AJAX dispatcher, which fails to enforce authentication before routing requests to admin-gated endpoints. Unauthenticated attackers can supply any X-Requested-With header and request a base64-encoded path resolving to any *-ajax.php file in the codebase. This allows adversaries to reach privileged plugin endpoints without credentials. Exploitation enables actions such as manipulating poll states and vote counts, and amplifies the impact of any dangerous operation performed by admin-only AJAX files across the plugin tree. The issue is tracked under [CWE-306] Missing Authentication for Critical Function.

Critical Impact
Unauthenticated network attackers can invoke any admin-gated AJAX endpoint in MaxSite CMS, resulting in high impact to confidentiality, integrity, and availability.

Affected Products

MaxSite CMS version 109.5
All prior MaxSite CMS releases exposing the AJAX dispatcher
MaxSite CMS plugins that ship *-ajax.php handlers assuming admin context

Discovery Timeline

2026-08-04 - CVE-2026-70552 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-70552

Vulnerability Analysis

MaxSite CMS routes AJAX requests through a central dispatcher that accepts a base64-encoded path parameter. The dispatcher decodes the path and includes the corresponding *-ajax.php file to service the request. The dispatcher gates access on the presence of an X-Requested-With header rather than a validated session or capability check. Any client that sets that header, regardless of value, is treated as an authorized AJAX caller. Because the dispatcher does not distinguish between public and admin-only handler files, attackers can request any handler in the plugin tree. Plugin authors write admin-only *-ajax.php files assuming the dispatcher enforces authentication, so those handlers omit their own access checks. The result is a systemic bypass that scales with the number of installed plugins.

Root Cause

The root cause is missing authentication on a critical dispatch function [CWE-306]. The dispatcher conflates a client-controlled header with proof of authenticated session state. It also permits arbitrary include targets by base64-decoding the requested path without restricting the resolved file to a public handler allowlist.

Attack Vector

Exploitation requires only network access to the target site. The attacker sends a single HTTP request to the AJAX endpoint, includes any X-Requested-With header value, and supplies a base64-encoded path pointing to the target admin AJAX handler. No credentials, tokens, or user interaction are required. The attacker then invokes whichever privileged action the reached handler exposes. Detailed technical analysis is available in the VulnCheck Advisory on MaxSite CMS.

Detection Methods for CVE-2026-70552

Indicators of Compromise

HTTP requests to the AJAX dispatcher containing an X-Requested-With header from unauthenticated sessions or clients with no prior login activity.
Query or POST parameters carrying base64-encoded strings that decode to paths ending in -ajax.php.
Access log entries referencing plugin AJAX handlers from IP addresses that never authenticated to /admin routes.
Unexpected mutations in poll records, vote counts, or plugin state without a corresponding admin session.

Detection Strategies

Decode inbound path or dispatch parameters and alert when the resolved target matches *-ajax.php files reserved for admin plugins.
Correlate AJAX dispatcher hits with authentication events and flag calls that lack a preceding successful login.
Baseline normal AJAX endpoint usage per plugin and alert on first-seen handlers being invoked externally.

Monitoring Recommendations

Enable verbose web server logging that captures full request URIs, headers, and POST bodies for the MaxSite CMS AJAX endpoint.
Forward web logs to a centralized analytics platform and retain them long enough to hunt retroactively once patches ship.
Monitor database tables backing polls, votes, and plugin configuration for out-of-band changes.

How to Mitigate CVE-2026-70552

Immediate Actions Required

Restrict access to the MaxSite CMS AJAX dispatcher at the web server or WAF layer until an upstream patch is applied.
Audit installed plugins for *-ajax.php handlers that perform sensitive operations and add explicit capability checks inside each file.
Review web server access logs for prior exploitation attempts referencing base64-encoded paths.

Patch Information

Refer to the vendor project pages for fixed releases: the GitHub MaxSite CMS Repository and the Max-3000 CMS Page. Upgrade to a release later than 109.5 that enforces authenticated session validation inside the AJAX dispatcher.

Workarounds

Block or rewrite requests to the AJAX endpoint that carry base64-encoded paths targeting admin plugin files.
Require an authenticated session cookie at the reverse proxy before forwarding traffic to ajax.php.
Temporarily disable non-essential plugins whose *-ajax.php handlers perform state changes.

bash

# Example nginx location block restricting the AJAX dispatcher
location = /ajax.php {
    if ($http_cookie !~* "maxsite_session=") {
        return 403;
    }
    include fastcgi_params;
    fastcgi_pass unix:/run/php/php-fpm.sock;
}