Is CVE-2026-27741 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-27741 being exploited in the wild.

How severe is CVE-2026-27741?

Medium severity, with a CVSS score of 4.3, published 23 February 2026.

Is there a fix for CVE-2026-27741?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-27741 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-27741?

Check whether you run Bludit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-27741: Bludit CSRF in plugin and theme management endpoints

CVE-2026-27741 · Severity: medium · CVSS 4.3 · Published 2026-02-23

Bludit, a flat-file content management system, is vulnerable to an attack that could allow unauthorized changes to a website's configuration. By tricking a logged-in administrator into clicking a malicious link, an attacker can force the website to uninstall plugins or install new themes without the administrator's consent. This could lead to a loss of website functionality or the introduction of malicious code through unauthorized themes.

Technologies: Bludit. Vendors: Bludit.

Quick answers

Is CVE-2026-27741 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-27741 being exploited in the wild.
How severe is CVE-2026-27741?: Medium severity, with a CVSS score of 4.3, published 23 February 2026.
Which products and versions are affected?: Bludit <= 3.16.1.
Is there a fix for CVE-2026-27741?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-27741 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-27741?: Check whether you run Bludit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Cross-Site Request Forgery (CSRF) vulnerability exists in Bludit version 3.16.1 within the '/admin/uninstall-plugin/' and '/admin/install-theme/' endpoints. The application fails to implement anti-CSRF tokens or validate request origins (Referer/Origin headers) for these sensitive administrative actions. An attacker can exploit this by hosting a malicious HTML page that uses JavaScript to silently submit requests to a victim's Bludit instance. If an authenticated administrator visits the malicious page, the attacker can force the uninstallation of plugins or the installation of arbitrary themes. This could result in a denial of service for specific site features or remote code execution if a malicious theme is installed. As of the advisory date, the issue was reported in GitHub issue #1577 and remains unpatched in version 3.16.1.

Affected products

Bludit Bludit <= 3.16.1

Timeline

2024-08-21: disclosed: Vulnerability reported on GitHub issues
2026-02-23: advisory: NVD and VulnCheck published advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.