# CVE-2026-27741: Bludit CSRF in plugin and theme management endpoints

Source: https://junglewise.ai/threats/cve-2026-27741-bludit-csrf-in-plugin-and-theme-management-endpoints  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-02-23. Updated: 2026-07-14  
License: CC BY 4.0 with a link back

CVE-2026-27741 · Severity: medium · CVSS 4.3 · Published 2026-02-23

Bludit, a flat-file content management system, is vulnerable to an attack that could allow unauthorized changes to a website's configuration. By tricking a logged-in administrator into clicking a malicious link, an attacker can force the website to uninstall plugins or install new themes without the administrator's consent. This could lead to a loss of website functionality or the introduction of malicious code through unauthorized themes.

Technologies: [Bludit](https://junglewise.ai/threats/technologies/bludit). Vendors: [Bludit](https://junglewise.ai/threats/vendors/bludit).

## Quick answers

**Is CVE-2026-27741 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-27741 being exploited in the wild.

**How severe is CVE-2026-27741?** Medium severity, with a CVSS score of 4.3, published 23 February 2026.

**Which products and versions are affected?** Bludit <= 3.16.1.

**Is there a fix for CVE-2026-27741?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-27741 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-27741?** Check whether you run Bludit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Cross-Site Request Forgery (CSRF) vulnerability exists in Bludit version 3.16.1 within the '/admin/uninstall-plugin/' and '/admin/install-theme/' endpoints. The application fails to implement anti-CSRF tokens or validate request origins (Referer/Origin headers) for these sensitive administrative actions. An attacker can exploit this by hosting a malicious HTML page that uses JavaScript to silently submit requests to a victim's Bludit instance. If an authenticated administrator visits the malicious page, the attacker can force the uninstallation of plugins or the installation of arbitrary themes. This could result in a denial of service for specific site features or remote code execution if a malicious theme is installed. As of the advisory date, the issue was reported in GitHub issue #1577 and remains unpatched in version 3.16.1.

## Affected products

- Bludit Bludit <= 3.16.1

## Timeline

- 2024-08-21: disclosed: Vulnerability reported on GitHub issues
- 2026-02-23: advisory: NVD and VulnCheck published advisory

## References

- [https://github.com/bludit/bludit/issues/1577](https://github.com/bludit/bludit/issues/1577)
- [https://www.vulncheck.com/advisories/bludit-csrf-in-plugin-and-theme-management-endpoints](https://www.vulncheck.com/advisories/bludit-csrf-in-plugin-and-theme-management-endpoints)

## Related threats

- [Bludit stored cross-site scripting in logo upload](https://junglewise.ai/threats/cve-2026-72576-bludit-stored-cross-site-scripting-in-logo-upload)
- [Bludit directory traversal in api/plugin.php](https://junglewise.ai/threats/cve-2026-50869-bludit-directory-traversal-in-api-plugin-php)
- [Bludit CMS remote code execution in API Plugin](https://junglewise.ai/threats/cve-2026-38329-bludit-cms-remote-code-execution-in-api-plugin)
- [Bludit insufficient session expiration for disabled accounts](https://junglewise.ai/threats/cve-2026-46657-bludit-insufficient-session-expiration-for-disabled-accounts)
- [Bludit CMS broken access control via ghost sessions](https://junglewise.ai/threats/cve-2026-46656-bludit-cms-broken-access-control-via-ghost-sessions)