CVE-2026-70552: Missing Authentication for Critical Function in MaxSite MaxSite CMS
MaxSite CMS 109.5 and earlier contains an authentication bypass vulnerability in the AJAX dispatcher that allows unauthenticated attackers to access admin-gated endpoints by supplying any X-Requested-With header and requesting a base64-encoded path resolving to any *-ajax.php file in the codebase. Attackers can exploit this dispatcher bypass to reach privileged plugin endpoints without credentials, enabling actions such as manipulating poll states and vote counts, and amplifying the impact of any dangerous operation performed by admin-only ajax files across the plugin tree.
AI Analysis
Technical Summary
CVE-2026-70552 affects MaxSite CMS 0.78 and earlier, where the AJAX dispatcher fails to enforce authentication properly. By providing any X-Requested-With header and a base64-encoded path resolving to an administrative AJAX PHP file, attackers can bypass authentication controls and invoke privileged plugin endpoints without credentials. This vulnerability permits unauthorized actions including manipulation of poll states and vote counts, thereby increasing the risk of unauthorized administrative operations within the CMS plugin ecosystem.
Potential Impact
The vulnerability allows unauthenticated attackers to bypass authentication and access admin-only AJAX endpoints. This can lead to unauthorized manipulation of poll states and vote counts, and potentially other dangerous operations restricted to administrators. The impact is critical due to the ability to perform privileged actions without credentials, compromising the integrity of the CMS and its plugins.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected AJAX endpoints by network controls or disable vulnerable plugins if possible.
CVE-2026-70552: Missing Authentication for Critical Function in MaxSite MaxSite CMS
Description
MaxSite CMS 109.5 and earlier contains an authentication bypass vulnerability in the AJAX dispatcher that allows unauthenticated attackers to access admin-gated endpoints by supplying any X-Requested-With header and requesting a base64-encoded path resolving to any *-ajax.php file in the codebase. Attackers can exploit this dispatcher bypass to reach privileged plugin endpoints without credentials, enabling actions such as manipulating poll states and vote counts, and amplifying the impact of any dangerous operation performed by admin-only ajax files across the plugin tree.
CVSS v4.0
Score 9.3critical
Affected software
MaxSite
MaxSite CMS
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-70552 affects MaxSite CMS 0.78 and earlier, where the AJAX dispatcher fails to enforce authentication properly. By providing any X-Requested-With header and a base64-encoded path resolving to an administrative AJAX PHP file, attackers can bypass authentication controls and invoke privileged plugin endpoints without credentials. This vulnerability permits unauthorized actions including manipulation of poll states and vote counts, thereby increasing the risk of unauthorized administrative operations within the CMS plugin ecosystem.
Potential Impact
The vulnerability allows unauthenticated attackers to bypass authentication and access admin-only AJAX endpoints. This can lead to unauthorized manipulation of poll states and vote counts, and potentially other dangerous operations restricted to administrators. The impact is critical due to the ability to perform privileged actions without credentials, compromising the integrity of the CMS and its plugins.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected AJAX endpoints by network controls or disable vulnerable plugins if possible.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-08-04T19:19:05.906Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a724793bf8831d539613968
Added to database: 08/04/2026, 20:12:03 UTC
Last enriched: 08/12/2026, 15:50:37 UTC
Last updated: 09/17/2026, 22:01:37 UTC
Views: 62
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.