Description
Bludit version 3.16.1 contains a cross-site request forgery (CSRF) vulnerability in the /admin/uninstall-plugin/ and /admin/install-theme/ endpoints. The application does not implement anti-CSRF tokens or other request origin validation mechanisms for these administrative actions. An attacker can induce an authenticated administrator to visit a malicious page that silently submits crafted requests, resulting in unauthorized plugin uninstallation or theme installation. This may lead to loss of functionality, execution of untrusted code via malicious themes, and compromise of system integrity.
Published: 2026-02-23
Score: 5.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized plugin removal or malicious theme installation via CSRF, enabling loss of functionality and potential integrity compromise,
Action: Immediate Patch
AI Analysis

Impact

Bludit 3.16.1 allows cross‑site request forgery against the /admin/uninstall-plugin/ and /admin/install-theme/ endpoints because it lacks anti‑CSRF tokens or request origin validation. An attacker can induce an authenticated administrator to visit a malicious page that silently submits crafted requests, resulting in untrusted code being installed as a theme or critical plugins being removed. This damages normal operations, may embed malicious code, and can compromise the overall system integrity.

Affected Systems

Bludit – the content management system – is affected for version 3.16.1 and all earlier releases. Any installation of Bludit using these versions is vulnerable to the described CSRF exploit.

Risk and Exploitability

The CVSS score is 5.1, indicating moderate severity. The EPSS score is below 1 %, suggesting a low but nonzero probability of exploitation in the wild, and the vulnerability is not listed in the KEV catalogue. The attack vector is browser‑based CSRF; it requires the attacker to persuade a logged‑in administrator to visit a crafted page, after which the browser will send the privileged request. No additional system compromise is required beyond the administrator session, making the flaw readily exploitable on any site with an exposed admin interface.

Generated by OpenCVE AI on April 16, 2026 at 16:34 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to the latest Bludit release that includes a CSRF fix (e.g., 3.16.2 or newer).
  • If upgrading is delayed, restrict the /admin/uninstall-plugin/ and /admin/install-theme/ endpoints to trusted IP addresses or enforce an additional authentication layer using server‑side access controls.
  • Implement anti‑CSRF protection on these administrative actions by adding per‑session tokens to form submissions and validating them on the server; consider community patches or a security plugin that enforces such checks.

Generated by OpenCVE AI on April 16, 2026 at 16:34 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 05 Mar 2026 02:15:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:bludit:bludit:*:*:*:*:*:*:*:*

Fri, 27 Feb 2026 06:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 26 Feb 2026 03:15:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:bludit:bludit:3.16.1:*:*:*:*:*:*:*

Tue, 24 Feb 2026 10:00:00 +0000

Type Values Removed Values Added
First Time appeared Bludit
Bludit bludit
Vendors & Products Bludit
Bludit bludit

Mon, 23 Feb 2026 22:15:00 +0000

Type Values Removed Values Added
Description Bludit version 3.16.1 contains a cross-site request forgery (CSRF) vulnerability in the /admin/uninstall-plugin/ and /admin/install-theme/ endpoints. The application does not implement anti-CSRF tokens or other request origin validation mechanisms for these administrative actions. An attacker can induce an authenticated administrator to visit a malicious page that silently submits crafted requests, resulting in unauthorized plugin uninstallation or theme installation. This may lead to loss of functionality, execution of untrusted code via malicious themes, and compromise of system integrity.
Title Bludit <= 3.16.1 CSRF in Plugin and Theme Management Endpoints
Weaknesses CWE-352
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Bludit Bludit
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-03-05T01:31:23.241Z

Reserved: 2026-02-23T21:38:48.841Z

Link: CVE-2026-27741

cve-icon Vulnrichment

Updated: 2026-02-25T15:35:48.132Z

cve-icon NVD

Status : Analyzed

Published: 2026-02-23T22:16:25.233

Modified: 2026-02-26T03:03:26.457

Link: CVE-2026-27741

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-16T16:45:25Z

Weaknesses