External risk intelligence

Pluck CMS CSRF Vulnerability Allows Stored XSS and RCE

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-70376

Pluck is a CMS application designed to manage web content. CMS admin panels are commonly deployed as web-accessible interfaces to allow site administrators to manage content remotely. Because the vulnerable function governs administrative actions within a web application, it is likely to be reachable via the internet in standard deployments.

Cross-site Request Forgery

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability in Pluck CMS's administrative functions could allow an attacker to perform unauthorized actions, including creating malicious content or installing unauthorized modules, by bypassing security checks. The core issue lies in how the system verifies the origin of requests, which can be tricked by an attacker-controlled webpage.

Admin panel can be tricked into accepting bad requests.
Confirms a specific type of administrative security flaw.
Assess if Pluck CMS is in use and needs review.

Attack Path

How an attacker could exploit the issue

An attacker can trick an authenticated administrator into performing actions on Pluck CMS by forging requests. By manipulating the Referer header, an attacker can bypass Pluck CMS's administrative panel security, leading to potential remote code execution or stored cross-site scripting vulnerabilities.

No Referer header allows requests.
Forged requests trigger administrative actions.
Remote code execution and stored XSS.

Live Threat

Current exploitation, exposure, and threat context

When an administrator visits a malicious website, this vulnerability could allow a cross-site attacker to execute administrative actions on their behalf. This could lead to the creation of pages with stored cross-site scripting (XSS) vulnerabilities or the installation of unauthorized PHP modules, enabling remote code execution.

Administrator actions could be compromised.
Attackers can suppress the Referer header.
Remote code execution and stored XSS are possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

Pluck CMS administrators are responsible for securing their content management systems. The first step is to identify all instances of Pluck CMS, determine their accessibility and business criticality, and then assign ownership for remediation.

Assign ownership to the application owner.
Verify external reachability and business impact.
Plan remediation during the next maintenance window.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Pluck CMS?

Pluck CMS is a lightweight, open-source content management system designed to help users build and manage websites without needing extensive technical knowledge. It is built using PHP and provides an administrative panel where site owners can create pages, upload content, and extend site functionality through modules and themes.

How does CVE-2026-70376 affect Pluck CMS?

This vulnerability is a Cross-Site Request Forgery (CWE-352). Instead of using secure, unique tokens for each action, the admin panel only checks the Referer header to verify where a request came from. Because this check is flawed, an attacker can trick an authenticated administrator's browser into performing unauthorized administrative tasks.

When does this vulnerability trigger?

It triggers when an administrator with an active session visits a malicious website that forces their browser to send requests to the Pluck CMS admin panel. It does not trigger if there is no active admin session, and importantly, the flaw is triggered when the request lacks Referer information, allowing the system to mistakenly accept the forged request as legitimate.

Is my Pluck CMS instance at risk?

According to Halo Surface Signal, because Pluck CMS manages web content, its admin panel is typically exposed to the internet to allow remote management. If your installation is accessible via a web browser, it is likely reachable by an attacker, making it important to evaluate your deployment's visibility.

What should I do if I use Pluck CMS?

You should immediately identify where Pluck CMS is running in your environment and confirm who is responsible for its maintenance. Since this issue allows critical actions like remote code execution, you must prioritize reviewing your configuration and planning for updates or security hardening during your next available maintenance window.

References

github.com/pluck-cms/pluck

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.