CVE-2026-70552 is an authentication bypass vulnerability affecting MaxSite CMS 0.78 and earlier. The issue resides in the AJAX dispatcher, which improperly grants access to admin-gated endpoints when an attacker supplies any X-Requested-With header and a base64-encoded path resolving to any *-ajax.php file. This bypass enables unauthenticated attackers to invoke privileged plugin endpoints without credentials, allowing unauthorized actions including manipulation of poll states and vote counts, thereby increasing the risk posed by any admin-only AJAX operations within plugins.

The vulnerability allows unauthenticated attackers to bypass authentication controls and access admin-level AJAX endpoints. This can lead to unauthorized modification of application state, such as changing poll results, and potentially other dangerous operations restricted to administrators. The CVSS 4.0 score of 9.3 reflects a critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected AJAX endpoints through network controls or web application firewalls to prevent unauthenticated access. Monitor vendor channels for updates and apply patches promptly once released.