Vulnerability Analysis
MaxSite CMS 109.5 Unauthenticated AJAX Dispatcher Bypass via ajax.php
CVE-2026-70552
MaxSite CMS 109.5 and earlier contains an authentication bypass vulnerability in the AJAX dispatcher that allows unauthenticated attackers to access admin-gated endpoints by supplying any X-Requested-With header and requesting a base64-encoded path resolving to any *-ajax.php file in the codebase. Attackers can exploit this dispatcher bypass to reach privileged plugin endpoints without credentials, enabling actions such as manipulating poll states and vote counts, and amplifying the impact of any dangerous operation performed by admin-only ajax files across the plugin tree.
No Active Exploit Signals
CVSS Base Score
9.3
CRITICAL
Exploitability:-
Impact Score:-
Temporal Score:-
EPSS:0.57%
Threat Intelligence Signals
CISA KEV
No
KEV Date Added
—
Ransomware Use
—
KEV Due Date
—
VulnCheck In-the-Wild
No
Nuclei Template
No
EPSS Score
0.566%
EPSS Percentile
43.8th pct
GHSA ID
GitHub Severity
CRITICAL
SSVC Exploitation
None
SSVC Automatable
Yes
Vulnerability Class
—
Identity & Timeline
| Status | - |
| Assigning Authority | - |
| CVSS Version / Source | - |
| Reserved | - |
| Published | - |
| Patch Date (date_public) | - |
| Exploit DB Date | - |
| First GitHub PoC Date | - |
| Last Updated | - |
| Time to Patch (Days to fix) | - |
| Exploit Release Gap | - |
| PoC Release Gap | - |
| Exploit DB References | None identified |
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| No affected products specified. | ||
Social Buzz