MaxSite CMS CVE-2026-70552

Exploitation requires only that the MaxSite CMS AJAX dispatcher be network-reachable (the default for a running site) and that the target run version 109.5 or earlier. The attacker must (1) supply any value for the X-Requested-With request header, which the dispatcher trusts as proof of a legitimate AJAX call, and (2) supply a base64-encoded path that resolves to a file matching the *-ajax.php naming pattern in the codebase. No credentials, session, or user interaction are needed (PR:N/UI:N). The practical limiting factor is impact scope rather than access: the severity of what an attacker can do depends on which admin-only *-ajax.php handlers exist in the specific installation and plugin set - the confirmed effect is poll/vote manipulation, while broader confidentiality or availability impact is contingent on the dangerous operations exposed by other admin AJAX files present.

The vendor CVSS 4.0 score of 9.3 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) reflects a network-reachable, low-complexity, unauthenticated flaw with high impact - consistent with the description, which requires only a crafted HTTP request against a default-reachable endpoint. There is no EPSS score, no SSVC decision, and no KEV listing in the provided data, so real-world exploitation cannot be confirmed and appears to be neither active nor mass-scanned at this time. The high VC/VI/VA rating is somewhat optimistic relative to the concretely demonstrated impact: the description proves integrity abuse (poll and vote manipulation) and states that the bypass 'amplifies the impact of any dangerous operation' in admin AJAX files, meaning full confidentiality/availability impact depends on what specific *-ajax.php handlers exist in a given deployment rather than being universally guaranteed. Net assessment: a genuine, easy-to-exploit unauthenticated access-control break that warrants prompt patching, tempered by the fact that MaxSite CMS is a niche product and no exploitation or POC has been observed in the provided intelligence.

An unauthenticated attacker sends an HTTP request to the MaxSite CMS AJAX dispatcher, adding an arbitrary X-Requested-With header and a base64-encoded path pointing to a privileged handler such as a poll plugin's admin *-ajax.php file. The dispatcher loads and executes the admin handler without any credential check, letting the attacker alter poll states and inflate or reset vote counts, and reach any other admin-only AJAX operation present in the plugin tree. No POC is provided in the source data, but the low attack complexity and lack of authentication make reliable exploitation straightforward.