Pluck CMS's admin panel relies solely on a Referer-header comparison (requestedByTheSameDomain() in data/inc/functions.admin.php, gating every admin.php action)…

CVE-2026-70376 affects Pluck CMS, where the admin panel relies solely on Referer-header comparison for CSRF protection via the requestedByTheSameDomain() function in data/inc/functions.admin.php. No per-request anti-CSRF token is implemented anywhere in the admin area. A logic flaw causes the function to return true (treating the request as same-origin) when no Referer or Host header is present. An attacker can suppress the Referer header using a meta referrer tag set to no-referrer, bypassing the protection entirely. This allows forged cross-site requests to be submitted on behalf of an authenticated administrator. Exploitable actions include creating pages with raw HTML, enabling stored XSS via rendered pages. Additionally, attackers can install PHP modules or themes, leading to remote code execution. The vulnerability chain combines CSRF, stored XSS, and RCE, making it critical severity.