CVE-2026-70376 identifies a Cross-Site Request Forgery (CSRF) vulnerability in Pluck CMS where the admin panel relies solely on Referer-header validation for CSRF protection. The absence of per-request anti-CSRF tokens in the admin area means that an attacker can craft malicious requests that the system may accept as legitimate, leading to unauthorized actions within the admin interface. This vulnerability is classified under CWE-352 and has a CVSS v3.1 score of 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), reflecting its critical severity and potential for complete compromise of the affected system.

Successful exploitation can lead to unauthorized administrative actions, resulting in full compromise of confidentiality, integrity, and availability of the Pluck CMS installation. Attackers could manipulate content, change configurations, or disrupt service without needing prior authentication privileges beyond a user with UI interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider implementing additional CSRF protections such as per-request anti-CSRF tokens or other compensating controls to mitigate the risk. Monitoring for suspicious admin actions and restricting access to the admin panel by IP or VPN may reduce exposure.