Is CVE-2026-70552 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-70552 being exploited in the wild.

How severe is CVE-2026-70552?

Critical severity, with a CVSS score of 9.8, published 4 August 2026.

Is there a fix for CVE-2026-70552?

A patch was published on 2026-03-16: Fixed in MaxSite CMS 109.6 (security update released 2026-03-16) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-70552 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-70552?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-70552: MaxSite CMS authentication bypass in AJAX dispatcher

CVE-2026-70552 · Severity: critical · CVSS 9.8 · Published 2026-08-04

MaxSite CMS is a content management system used to build websites and blogs. An unauthenticated attacker can bypass authentication on admin-only features by sending specially crafted AJAX requests with a fake header and base64-encoded paths, allowing them to manipulate website data, modify poll votes, and invoke any dangerous operations normally restricted to administrators without needing valid credentials.

Quick answers

Is CVE-2026-70552 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-70552 being exploited in the wild.
How severe is CVE-2026-70552?: Critical severity, with a CVSS score of 9.8, published 4 August 2026.
Which products and versions are affected?: MaxSite CMS 109.5 and earlier.
Is there a fix for CVE-2026-70552?: A patch was published on 2026-03-16: Fixed in MaxSite CMS 109.6 (security update released 2026-03-16) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-70552 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-70552?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an authentication bypass affecting the AJAX dispatcher in MaxSite CMS version 109.5 and earlier. An attacker can supply any X-Requested-With header and request a base64-encoded path resolving to any *-ajax.php file to reach privileged plugin endpoints without authentication. The flaw allows unauthenticated remote access to admin-gated endpoints, enabling manipulation of poll states and vote counts, and exploitation of any dangerous operations performed by admin-only AJAX files. The vulnerability was patched in version 109.6, released 2026-03-16, and an exploit was publicly disclosed prior to patching (discovered January-February 2026).

Affected products

MaxSite CMS 109.5 and earlier

Timeline

2026-01: disclosed: Vulnerability discovered and reported January-February 2026
2026-03-16: patched: Fixed in MaxSite CMS 109.6 (security update released 2026-03-16)
2026-08-04: exploited: Exploit publicly disclosed before CVE publication; CVE-2026-70552 published 2026-08-04
2026-08-04: advisory: CVE-2026-70552 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.