{"id":"CVE-2026-70376","title":"Pluck CMS's admin panel relies solely on a Referer-header comparison (requestedByTheSameDomain in data/inc/functions.admin.php, gating every admin.php action) for CSRF protection, with no per-request anti-CSRF token anywhere in the admin…","summary":"Pluck CMS's admin panel relies solely on a Referer-header comparison (requestedByTheSameDomain in data/inc/functions.admin.php, gating every admin.php action) for CSRF protection, with no per-request anti-CSRF token anywhere in the admin…","severity":"critical","cvss":9.6,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","cwe":["CWE-352"],"published":"2026-08-05","updated":"2026-08-10","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70376","references":[{"url":"https://github.com/pluck-cms/pluck","label":"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}],"tags":["nvd","exploit-available"],"epss":0.00169,"epssPercentile":0.06643,"ingestedAt":"2026-08-10T12:39:48.101Z","exploits":{"github":1,"githubRepos":["https://github.com/IlhomjonR/CVE-2026-70376"],"checkedAt":"2026-09-21T15:30:20.578Z"},"exploitAvailable":true,"slug":"CVE-2026-70376","body":"## Overview\n\nPluck CMS's admin panel relies solely on a Referer-header comparison (requestedByTheSameDomain in data/inc/functions.admin.php, gating every admin.php action) for CSRF protection, with no per-request anti-CSRF token anywhere in the admin area.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"abyssal","depthScore":65,"depthScoreParts":{"impact":52.8,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[{"seq":5451,"id":"CVE-2026-70376","ts":1788887282965,"field":"exploit_available","old":"false","new":"true"},{"seq":4334,"id":"CVE-2026-70376","ts":1788886396642,"field":"exploit_available","old":"true","new":"false"},{"seq":3063,"id":"CVE-2026-70376","ts":1788883060332,"field":"exploit_available","old":"false","new":"true"},{"seq":2092,"id":"CVE-2026-70376","ts":1788882465119,"field":"exploit_available","old":"true","new":"false"},{"seq":1158,"id":"CVE-2026-70376","ts":1788881902209,"field":"exploit_available","old":"false","new":"true"}]}