This flaw allows an attacker to bypass authentication by sending an X-Requested-With header and a base64‑encoded path pointing to any *-ajax.php file in the codebase. The ability to call admin‑gated AJAX endpoints without credentials lets an attacker perform privileged actions such as changing poll states and manipulating vote counts. The flaw is a classic missing authentication issue (CWE‑306) and poses serious confidentiality, integrity, and availability risks because any dangerous operation contained in admin‑only AJAX files can be executed by an unauthenticated user.

The vulnerability affects MaxSite CMS 109.5 and all earlier releases. No exact version range is provided, so all builds at or below 109.5 are potentially impacted.

The CVSS score of 9.3 indicates a high severity with a broad impact scope. The EPSS score is not available, but the absence of a KEV listing does not reduce the likelihood of exploitation in practice. Attackers can simply craft an HTTP request with the appropriate headers and payload path, without needing any credentials or pre‑existing access. This straightforward web‑based bypass makes exploitation highly probable for any exposed instance of the affected CMS.