CVE-2026-27741

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-27741
Bludit version 3.16.1 contains a cross-site request forgery (CSRF) vulnerability in the /admin/uninstall-plugin/ and /admin/install-theme/ endpoints. The application does not implement anti-CSRF tokens or other request origin validation mechanisms for these administrative actions. An attacker can induce an authenticated administrator to visit a malicious page that silently submits crafted requests, resulting in unauthorized plugin uninstallation or theme installation. This may lead to loss of functionality, execution of untrusted code via malicious themes, and compromise of system integrity.

4.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/bludit/bludit/issues/1577 Exploit Issue Tracking
https://www.vulncheck.com/advisories/bludit-csrf-in-plugin-and-theme-management-endpoints Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:bludit:bludit:3.16.1:*:*:*:*:*:*:*
History

26 Feb 2026, 03:03

Type Values Removed Values Added
Summary
  • (es) La versión 3.16.1 de Bludit contiene una vulnerabilidad de falsificación de petición en sitios cruzados (CSRF) en los endpoints /admin/uninstall-plugin/ y /admin/install-theme/. La aplicación no implementa tokens anti-CSRF u otros mecanismos de validación de origen de la petición para estas acciones de administración. Un atacante puede inducir a un administrador autenticado a visitar una página maliciosa que envía silenciosamente peticiones manipuladas, lo que resulta en la desinstalación no autorizada de un plugin o la instalación de un tema. Esto puede llevar a la pérdida de funcionalidad, la ejecución de código no confiable a través de temas maliciosos y el compromiso de la integridad del sistema.
CPE cpe:2.3:a:bludit:bludit:3.16.1:*:*:*:*:*:*:*
References () https://github.com/bludit/bludit/issues/1577 - () https://github.com/bludit/bludit/issues/1577 - Exploit, Issue Tracking
References () https://www.vulncheck.com/advisories/bludit-csrf-in-plugin-and-theme-management-endpoints - () https://www.vulncheck.com/advisories/bludit-csrf-in-plugin-and-theme-management-endpoints - Third Party Advisory
First Time Bludit
Bludit bludit

23 Feb 2026, 22:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-02-23 22:16

Updated : 2026-02-26 03:03

NVD link : CVE-2026-27741

Mitre link : CVE-2026-27741

CVE.ORG link : CVE-2026-27741

JSON object : View

Products Affected

bludit

  • bludit
CWE
CWE-352

Cross-Site Request Forgery (CSRF)