# CVE-2026-70552: MaxSite CMS authentication bypass in AJAX dispatcher

Source: https://junglewise.ai/threats/cve-2026-70552-maxsite-cms-authentication-bypass-in-ajax-dispatcher  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-04. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-70552 · Severity: critical · CVSS 9.8 · Published 2026-08-04

MaxSite CMS is a content management system used to build websites and blogs. An unauthenticated attacker can bypass authentication on admin-only features by sending specially crafted AJAX requests with a fake header and base64-encoded paths, allowing them to manipulate website data, modify poll votes, and invoke any dangerous operations normally restricted to administrators without needing valid credentials.

## Quick answers

**Is CVE-2026-70552 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-70552 being exploited in the wild.

**How severe is CVE-2026-70552?** Critical severity, with a CVSS score of 9.8, published 4 August 2026.

**Which products and versions are affected?** MaxSite CMS 109.5 and earlier.

**Is there a fix for CVE-2026-70552?** A patch was published on 2026-03-16: Fixed in MaxSite CMS 109.6 (security update released 2026-03-16) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-70552 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-70552?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an authentication bypass affecting the AJAX dispatcher in MaxSite CMS version 109.5 and earlier. An attacker can supply any X-Requested-With header and request a base64-encoded path resolving to any *-ajax.php file to reach privileged plugin endpoints without authentication. The flaw allows unauthenticated remote access to admin-gated endpoints, enabling manipulation of poll states and vote counts, and exploitation of any dangerous operations performed by admin-only AJAX files. The vulnerability was patched in version 109.6, released 2026-03-16, and an exploit was publicly disclosed prior to patching (discovered January-February 2026).

## Affected products

- MaxSite CMS 109.5 and earlier

## Timeline

- 2026-01: disclosed: Vulnerability discovered and reported January-February 2026
- 2026-03-16: patched: Fixed in MaxSite CMS 109.6 (security update released 2026-03-16)
- 2026-08-04: exploited: Exploit publicly disclosed before CVE publication; CVE-2026-70552 published 2026-08-04
- 2026-08-04: advisory: CVE-2026-70552 published

## References

- [https://github.com/maxsite/cms](https://github.com/maxsite/cms)
- [https://max-3000.com/page/maxsite-cms-109-6](https://max-3000.com/page/maxsite-cms-109-6)