CVE-2026-70552: MaxSite CMS 109.5 Unauthenticated AJAX Dispatcher Bypass via ajax.php
MaxSite CMS 109.5 and earlier contains an authentication bypass vulnerability in the AJAX dispatcher that allows unauthenticated attackers to access admin-gated endpoints by supplying any X-Requested-With header and requesting a base64-encoded path resolving to any -ajax.php file in the codebase. Attackers can exploit this dispatcher bypass to reach privileged plugin endpoints without credentials, enabling actions such as manipulating poll states and vote counts, and amplifying the impact of any dangerous operation performed by admin-only ajax files across the plugin tree.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MaxSite CMSto a version that resolves this vulnerability.Fixed in 109.5 - Configuration
Patch/adjust ajax.php AJAX dispatcher so unauthenticated requests cannot bypass admin gating; specifically, do not honor the presence of an X-Requested-With header as an authentication substitute.
MaxSite CMS AJAX dispatcher (ajax.php) Authentication requirement for admin-gated *-ajax.php endpoints = Require valid authentication (reject unauthenticated requests even if X-Requested-With header is supplied) - Compensating control
Add compensating access control for AJAX dispatcher routes so unauthenticated users cannot reach admin-gated endpoints (e.g., via web server/WAF rules limiting access to ajax.php/*-ajax.php to authenticated sessions only).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-70552?
The severity of CVE-2026-70552 is critical, rated at 9.3.
How do I fix CVE-2026-70552?
To fix CVE-2026-70552, upgrade to MaxSite CMS version 109.6 or later where the vulnerability has been patched.
What systems are affected by CVE-2026-70552?
CVE-2026-70552 affects MaxSite CMS version 109.5 and earlier.
What type of vulnerability is CVE-2026-70552?
CVE-2026-70552 is an unauthenticated AJAX dispatcher bypass vulnerability.
What could happen if CVE-2026-70552 is exploited?
If exploited, CVE-2026-70552 allows unauthenticated attackers to access admin-gated endpoints, potentially exposing sensitive data.