This vulnerability is a logic error in the VoteController class of light0011 CMS, triggered by manipulating the X-Requested-With HTTP header. The flaw causes the application to bypass normal vote validation, allowing an attacker to submit votes out of sequence, duplicate votes, or otherwise alter vote counts without authentication. The impact is remote, as an attacker only needs to send a crafted HTTP request to the CMS endpoints.

Affects installations of light0011 CMS. No specific product version is mentioned in the data, but the affected code resides in App/Home/Controller/VoteController.class.php within the Vote Handler component. Administrators should confirm whether this component is present in their deployment.

The CVSS score of 6.9 places the vulnerability in the medium severity range. An exploit is publicly available, and the attack vector is network‑based, requiring only the ability to send HTTP requests to the CMS. EPSS data is not available and the vulnerability is not yet listed in CISA KEV, but the existence of a documented exploit suggests that the risk to affected systems is significant and should be addressed promptly.