MaxSite CMS AJAX Dispatcher Authentication Bypass

Technical Analysis

CVE-2026-70552 (CVSS 9.8) stems from insufficient authentication checks in MaxSite CMS's central AJAX dispatcher, which routes requests to *-ajax.php files across the plugin directory tree. By supplying an arbitrary X-Requested-With header value alongside a base64-encoded target path, an unauthenticated attacker can bypass the dispatcher's access control logic and invoke privileged handlers directly. The severity is amplified because the vulnerability is not confined to a single plugin—any admin-only ajax.php file in the codebase, present or future, inherits the exposure, creating a broad and evolving attack surface. Demonstrated impact includes manipulation of poll states and vote counts, but the underlying flaw could expose more dangerous plugin operations (e.g., file writes, configuration changes, or data exfiltration) depending on installed plugins. This CMS-layer flaw has no direct connection to AI agent frameworks or LLM tool-use pipelines and does not warrant an agent-relevant tag.

Affected Systems

MaxSite CMS version 109.5 and all earlier versions; any installation exposing the AJAX dispatcher endpoint and associated *-ajax.php plugin files, particularly those with poll or voting plugins enabled

Indicators of Compromise

• Anomalous requests containing arbitrary/spoofed X-Requested-With headers
• Base64-encoded path parameters targeting *-ajax.php files in HTTP request logs
• Unexpected admin-endpoint access patterns from unauthenticated sessions
• Unusual spikes or anomalies in poll/vote count data

Remediation Steps

1. 1

   Upgrade MaxSite CMS

   Update to the latest patched version of MaxSite CMS once available from the vendor; monitor official channels for a security advisory and fix.

2. 2

   Restrict AJAX Dispatcher Access

   Implement web application firewall (WAF) rules to detect and block requests with anomalous X-Requested-With headers or suspicious base64-encoded paths targeting ajax.php endpoints.

3. 3

   Enforce Authentication at Proxy Layer

   Add reverse proxy or server-level authentication checks in front of admin-gated ajax endpoints as a compensating control until a patch is applied.

4. 4

   Audit Plugin Ajax Handlers

   Review all installed plugins for *-ajax.php files with admin-only operations and disable or restrict any that are not essential.

5. 5

   Monitor and Log Access

   Enable detailed logging of AJAX dispatcher requests and monitor for exploitation attempts, including unexpected poll/vote manipulation.