CVE-2026-27741

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-27741

4.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

B

ludit version 3.16.1 contains a cross-site request forgery (CSRF) vulnerability in the /admin/uninstall-plugin/ and /admin/install-theme/ endpoints. The application does not implement anti-CSRF tokens or other request origin validation mechanisms for these administrative actions. An attacker can induce an authenticated administrator to visit a malicious page that silently submits crafted requests, resulting in unauthorized plugin uninstallation or theme installation. This may lead to loss of functionality, execution of untrusted code via malicious themes, and compromise of system integrity.

References
Link Resource
https://github.com/bludit/bludit/issues/1577 Exploit Issue Tracking
https://www.vulncheck.com/advisories/bludit-csrf-in-plugin-and-theme-management-endpoints Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:bludit:bludit:3.16.1:*:*:*:*:*:*:*
History

26 Feb 2026, 03:03

Type Values Removed Values Added
First Time Bludit bludit
Bludit
References () https://github.com/bludit/bludit/issues/1577 - () https://github.com/bludit/bludit/issues/1577 - Exploit, Issue Tracking
References () https://www.vulncheck.com/advisories/bludit-csrf-in-plugin-and-theme-management-endpoints - () https://www.vulncheck.com/advisories/bludit-csrf-in-plugin-and-theme-management-endpoints - Third Party Advisory
CPE cpe:2.3:a:bludit:bludit:3.16.1:*:*:*:*:*:*:*
Summary
  • (es) La versión 3.16.1 de Bludit contiene una vulnerabilidad de falsificación de petición en sitios cruzados (CSRF) en los endpoints /admin/uninstall-plugin/ y /admin/install-theme/. La aplicación no implementa tokens anti-CSRF u otros mecanismos de validación de origen de la petición para estas acciones de administración. Un atacante puede inducir a un administrador autenticado a visitar una página maliciosa que envía silenciosamente peticiones manipuladas, lo que resulta en la desinstalación no autorizada de un plugin o la instalación de un tema. Esto puede llevar a la pérdida de funcionalidad, la ejecución de código no confiable a través de temas maliciosos y el compromiso de la integridad del sistema.

23 Feb 2026, 22:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-02-23 22:16

Updated : 2026-02-26 03:03

NVD link : CVE-2026-27741

Mitre link : CVE-2026-27741

CVE.ORG link : CVE-2026-27741

JSON object : View

Products Affected

bludit

CWE
CWE-352

Cross-Site Request Forgery (CSRF)