CVE-2026-70376

CRITICAL

Pluck CMS: CSRF via Spoofable Missing-Referer Bypass Leads to Stored XSS and RCE

Title source: cna

Exploitation Summary

EIP tracks 1 public exploit for CVE-2026-70376. PoCs published by IlhomjonR.

AI-analyzed exploit summary This repository contains a functional exploit for CVE-2026-70376, a CSRF vulnerability in Pluck CMS (<= 4.7.21-dev) caused by a fail-open Referer check. The exploit demonstrates how an attacker can bypass CSRF protections to perform destructive actions (file deletion) or achieve RCE via a double-extension file upload on Apache/mod_php hosts.

Description

Pluck CMS's admin panel relies solely on a Referer-header comparison (requestedByTheSameDomain in data/inc/functions.admin.php, gating every admin.php action) for CSRF protection, with no per-request anti-CSRF token anywhere in the admin area.

Exploits (1)

github WORKING POC

by IlhomjonR · pythonpoc

https://github.com/IlhomjonR/PluckCMS-CSRF-RCE

View Code ZIP pw:eip

This repository contains a functional exploit for CVE-2026-70376, a CSRF vulnerability in Pluck CMS (<= 4.7.21-dev) caused by a fail-open Referer check. The exploit demonstrates how an attacker can bypass CSRF protections to perform destructive actions (file deletion) or achieve RCE via a double-extension file upload on Apache/mod_php hosts.

Classification

Working Poc 99%

Attack Type

Rce

Complexity

Moderate

Reliability

Reliable

Target: Pluck CMS <= 4.7.21-dev

Auth required

Prerequisites: Victim must be a logged-in Pluck CMS admin · Victim must visit attacker-controlled page (or attacker must have admin session cookie) · For RCE: Target must be running Apache/mod_php with multi-extension handling enabled

MITRE ATT&CK

T1190 - Exploit Public-Facing Application T1059 - Command and Scripting Interpreter T1203 - Exploitation for Client Execution

mistral-large-3 · analyzed Aug 12, 2026 Full analysis →

References (1)

Core 1

Core References

third-party-advisory

https://github.com/pluck-cms/pluck

Scores

CVSS v3 9.6

EPSS 0.0013

EPSS Percentile 3.1%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-352

Status published

Products (1)

pluck-cms/Pluck CMS < 4.7.21

Published Aug 05, 2026

Tracked Since Aug 05, 2026