Read the docs
TI-2026-49274 Aliases CVE-2026-70552GHSA-r998-r395-678g

MaxSite CMS 109.5 Unauthenticated AJAX Dispatcher Bypass via ajax.php

Priority MEDIUM 50CWE-306Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-306.

Summary

MaxSite CMS 109.5 and earlier contains an authentication bypass vulnerability in the AJAX dispatcher that allows unauthenticated attackers to access admin-gated endpoints by supplying any X-Requested-With header and requesting a base64-encoded path resolving to any *-ajax.php file in the codebase. Attackers can exploit this dispatcher bypass to reach privileged plugin endpoints without credentials, enabling actions such as manipulating poll states and vote counts, and amplifying the impact of any dangerous operation performed by admin-only ajax files across the plugin tree.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00826 57th percentileScored 2026-11-07
Fix Fixed MaxSite CMS (MaxSite): 109.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MaxSiteMaxSite CMS0.78 – 109.5109.6Patch availableCNA
  • MaxSite CMS VendorMaxSite Affected 0.78 – 109.5 Fixed in 109.6 Patch available CNA

Remediation

  • Fix · CNA MaxSite CMS (MaxSite) Fixed in 109.6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-70552
  2. 2026-10-03 Alias added: GHSA-r998-r395-678g

References

Patch 1

Other 1

  • TI-2026-59994 MaxSite CMS through 109.6 Authentication Bypass via Hardcoded Encryption Key CVSS 4.0CRITICAL 9.3
  • TI-2026-59992 MaxSite CMS through 109.6 Local File Inclusion via ajax dispatcher CVSS 4.0HIGH 8.8
  • TI-2026-59995 MaxSite CMS through 109.6 PHP Object Injection via ci_session CVSS 4.0CRITICAL 9.2
  • TI-2026-02931 MaxSite CMS MarkItUp Preview AJAX Endpoint preview-ajax.php eval code injection CVSS 4.0MEDIUM 6.9
  • TI-2025-11324 MaxSite CMS save-file-ajax.php unrestricted upload CVSS 4.0MEDIUM 5.3
  • TI-2026-06140 MaxSite CMS ushki Plugin cross site scripting CVSS 4.0MEDIUM 4.8
See all 18 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences