A critical authentication bypass in MaxSite CMS 109.5 and earlier lets unauthenticated attackers reach admin-gated AJAX endpoints across the entire plugin tree, scored CVSS 9.8.
What Is It
MaxSite CMS ships an AJAX dispatcher that is supposed to gate privileged endpoints behind admin authentication. It doesn't. The dispatcher accepts any X-Requested-With header value and then resolves a base64-encoded path supplied by the requester, and it will happily resolve that path to any *-ajax.php file in the codebase.
The result is a missing authentication check for a critical function (CWE-306). An attacker with no credentials, no user interaction, and no prior access can invoke admin-only AJAX handlers directly over the network.
Why It Matters
VulnCheck assigned this a CVSS 3.1 base score of 9.8 (Critical) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, and a CVSS 4.0 score of 9.3. Network-reachable, low complexity, no privileges, no user interaction; the full unauthenticated remote profile, with high impact to confidentiality, integrity, and availability.
The demonstrated impact includes manipulating poll states and vote counts. Because the bypass sits in the dispatcher itself rather than in a single plugin, it plausibly amplifies the impact of any dangerous operation performed by admin-only AJAX files elsewhere in the plugin tree; though poll manipulation is the only exploitation path publicly demonstrated so far. If that generalization holds, the blast radius would scale with whatever plugins a given installation happens to run.
CVE-2026-70552 does not appear in the CISA Known Exploited Vulnerabilities catalog as of 2026-08-04, and VulnCheck lists exploit maturity as NOT_DEFINED, no public evidence of active exploitation at this time.
What's Vulnerable
- Vendor/Product: MaxSite / MaxSite CMS
- Affected: versions 0.78 through 109.5 (inclusive)
- Not affected: version 109.6
Patch Status
MaxSite CMS 109.6 is listed as unaffected. Upgrade to 109.6 or later. Given that the flaw requires no authentication and the affected range spans from 0.78 forward, long-lived installations should be treated as exposed until confirmed upgraded. No CISA-mandated remediation deadline applies, since the CVE is absent from the CISA Known Exploited Vulnerabilities catalog as of 2026-08-04 and therefore falls outside BOD 22-01 due-date requirements.
Sources
- NVD, CVE-2026-70552 (source: [email protected]), published 2026-08-04
- VulnCheck Advisory; https://www.vulncheck.com/advisories/maxsite-cms-unauthenticated-ajax-dispatcher-bypass-via-ajax-php
- CISA Known Exploited Vulnerabilities Catalog; https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- MaxSite CMS 109.6 Release; https://max-3000.com/page/maxsite-cms-109-6
- MaxSite CMS Source; https://github.com/maxsite/cms