CVE-2026-27741: Bludit <= 3.16.1 CSRF in Plugin and Theme Management Endpoints
Bludit version 3.16.1 contains a cross-site request forgery (CSRF) vulnerability in the /admin/uninstall-plugin/ and /admin/install-theme/ endpoints. The application does not implement anti-CSRF tokens or other request origin validation mechanisms for these administrative actions. An attacker can induce an authenticated administrator to visit a malicious page that silently submits crafted requests, resulting in unauthorized plugin uninstallation or theme installation. This may lead to loss of functionality, execution of untrusted code via malicious themes, and compromise of system integrity.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Bluditto a version that resolves this vulnerability.Fixed in 3.16.1 - Configuration
Mitigate CSRF by enabling anti-CSRF tokens and/or request origin validation for administrative actions on the /admin/uninstall-plugin/ and /admin/install-theme/ endpoints (Bludit v3.16.1 has none for these actions).
Bludit admin endpoints Anti-CSRF token / request origin validation = required
Event History
Frequently Asked Questions
What is the severity of CVE-2026-27741?
The severity of CVE-2026-27741 is rated as high due to the potential for unauthorized actions on the Bludit platform.
How do I fix CVE-2026-27741?
To fix CVE-2026-27741, upgrade Bludit to the latest version that addresses the CSRF vulnerability in the affected endpoints.
Which endpoints are affected by CVE-2026-27741?
CVE-2026-27741 affects the /admin/uninstall-plugin/ and /admin/install-theme/ endpoints of Bludit.
What type of vulnerability is CVE-2026-27741?
CVE-2026-27741 is classified as a cross-site request forgery (CSRF) vulnerability.
Who is affected by CVE-2026-27741?
Users of Bludit version 3.16.1 and prior are affected by CVE-2026-27741.