CVE-2026-70552: MaxSite CMS 109.5 Unauthenticated AJAX Dispatcher Bypass via ajax.php
MaxSite CMS 109.5 and earlier contains an authentication bypass vulnerability in the AJAX dispatcher that allows unauthenticated attackers to access admin-gated endpoints by supplying any X-Requested-With header and requesting a base64-encoded path resolving to any -ajax.php file in the codebase. Attackers can exploit this dispatcher bypass to reach privileged plugin endpoints without credentials, enabling actions such as manipulating poll states and vote counts, and amplifying the impact of any dangerous operation performed by admin-only ajax files across the plugin tree.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MaxSite CMSto a version that resolves this vulnerability.Fixed in 109.5 - Configuration
Patch/adjust ajax.php AJAX dispatcher so unauthenticated requests cannot bypass admin gating; specifically, do not honor the presence of an X-Requested-With header as an authentication substitute.
MaxSite CMS AJAX dispatcher (ajax.php) Authentication requirement for admin-gated *-ajax.php endpoints = Require valid authentication (reject unauthenticated requests even if X-Requested-With header is supplied) - Compensating control
Add compensating access control for AJAX dispatcher routes so unauthenticated users cannot reach admin-gated endpoints (e.g., via web server/WAF rules limiting access to ajax.php/*-ajax.php to authenticated sessions only).