CVE-2026-70552

CVE-2026-70552 is an authentication bypass in MaxSite CMS's AJAX dispatcher. The vulnerability is trivial to understand: the dispatcher checks for the X-Requested-With header—a header that XMLHttpRequest automatically sets—and treats its presence as proof the request is legitimate. An attacker can add this header to any request and bypass authentication entirely, gaining access to admin-level AJAX functionality. The practical impact depends heavily on what AJAX endpoints exist in your MaxSite installation. The dispatcher encodes target files in base64 before execution, but this encoding is not a security control—base64 decoding is trivial. The actual protection, such as it is, comes from extension validation that restricts execution to *-ajax.php files. This means the vulnerability grants access to whatever admin AJAX files are present in your installation. What matters most: check whether your MaxSite installation exposes any *-ajax.php files that perform privileged operations—database modifications, file writes, user management, or settings changes. Poll manipulation was cited as an example, but the real risk depends on what your specific installation has enabled. If you have legacy or unused plugins installed, their AJAX endpoints may now be reachable without authentication. The 9.8 CVSS score reflects the theoretical worst case: arbitrary admin AJAX execution. However, this is a ceiling, not a floor. Real-world exploitability requires chaining to a specific vulnerable endpoint. Treat this as high severity and patch promptly, but conduct your own impact assessment based on which AJAX files actually exist in your deployment rather than assuming the worst-case chain is automatically reachable. If you cannot patch immediately, consider blocking X-Requested-With at the web server level for non-whitelisted origins, or adding explicit authorization checks to your AJAX endpoints. The underlying architectural problem—that MaxSite's dispatcher treats AJAX requests as implicitly trusted—is the same mental shortcut many PHP CMS applications have made. Audit your own CMS implementations for similar patterns.

Reviewed through automated stages and approved by a human before publication.