EUVD-2026-53196
GHSA-qg2j-83g4-98r4
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Cross-site attacker needs no privileges (PR:N) but a logged-in admin must visit the page (UI:R); installed PHP modules execute as server code, changing scope (S:C) with full C/I/A impact.
Primary rating from Vendor (TuranSec).
CVSS VectorVendor: TuranSec
Lifecycle Timeline
3DescriptionCVE.org
Pluck CMS's admin panel relies solely on a Referer-header comparison (requestedByTheSameDomain() in data/inc/functions.admin.php, gating every admin.php action) for CSRF protection, with no per-request anti-CSRF token anywhere in the admin area. When a request carries no Referer/Host information, the function's elseif branch returns true, treating the request as same-origin. Because a cross-site attacker page can suppress the Referer header (e.g. via <meta name=referrer content=no-referrer>), it can force an authenticated administrator's browser to submit forged admin actions with no valid Referer, including creating pages with raw HTML (stored XSS via the rendered page) and installing PHP modules/themes (remote code execution).
Articles & Coverage 1
AnalysisAI
Cross-site request forgery in Pluck CMS's admin panel lets a remote attacker force a logged-in administrator's browser to execute forged admin.php actions, escalating to stored XSS (via raw-HTML page creation) and remote code execution (via malicious PHP module/theme installation). The admin area protects every action solely with a Referer-header check and ships no anti-CSRF tokens; because an attacker page can suppress the Referer header, the check's fallback branch treats headerless requests as same-origin and is bypassed. No public exploit or CISA KEV listing exists yet, but the CVSS 9.6 rating and trivial bypass make this a high-priority issue for exposed installs.
Technical ContextAI
Pluck CMS is a lightweight flat-file (no database) PHP content management system aimed at small websites, administered through a single admin.php dispatcher. The root cause is CWE-352 (Cross-Site Request Forgery): the requestedByTheSameDomain() function in data/inc/functions.admin.php gates all admin actions by comparing the HTTP Referer against the Host, but its elseif branch returns true when neither header is present - a fail-open design. Combined with the total absence of per-request anti-CSRF tokens, any state-changing admin action can be replayed cross-site. Modern browsers let an attacker deliberately strip the Referer (e.g. <meta name=referrer content=no-referrer> or Referrer-Policy), satisfying the headerless-equals-trusted branch. The CPE cpe:2.3:a:pluck-cms:pluck_cms:*:*:*:*:*:*:*:* indicates all versions are in scope pending vendor confirmation.
RemediationAI
No vendor-released patch identified at time of analysis - the sole reference (https://github.com/pluck-cms/pluck) is the project repository, not a tagged fix or advisory, so monitor that repository for a release that adds per-request anti-CSRF tokens and rewrites requestedByTheSameDomain() to fail closed on missing Referer/Host. Until a fix ships, apply compensating controls: restrict access to admin.php and the entire admin directory by source IP (via web-server allowlist or firewall) so forged requests from victim browsers on untrusted networks cannot reach it; place the admin panel behind a VPN or authenticated reverse proxy; and set a strict same-site session cookie policy (SameSite=Strict) on the admin session cookie to block cross-site request inclusion - note that SameSite=Strict can break legitimate cross-site links into the admin panel and may require admins to re-navigate internally. Administrators should also avoid browsing other sites while logged into the panel and log out immediately after use, since the attack requires an active authenticated session.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today