CVE-2026-70376

CVE-2026-70376 — Pluck CMS Site-wide CSRF → RCE Fail-open Referer check + no CSRF tokens + double-extension upload A single admin page-visit deletes content, injects pages, and drops a webshell At a glance · Summary · Root cause · Attack chain · Exploit · Remediation · Timeline 📋 At a glance |...