CVE-2026-27741 Bludit <= 3.16.1 CSRF in Plugin and Theme Management Endpoints
Attackers can trick admins into installing malicious themes or uninstalling plugins via CSRF, leading to code execution and system compromise.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-27741?
CVE-2026-27741 is a medium-severity vulnerability in Bludit, published on 23 Feb 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Bludit version 3.16.1 contains a cross-site request forgery (CSRF) vulnerability in the /admin/uninstall-plugin/ and /admin/install-theme/ endpoints. The application does not implement anti-CSRF tokens or other request origin validation mechanisms for these administrative actions. An attacker can induce an authenticated administrator to visit a malicious page that silently submits crafted requests, resulting in unauthorized plugin uninstallation or theme installation. This may lead to loss of functionality, execution of untrusted code via malicious themes, and compromise of system integrity.
Weakness: CWE-352
Which versions are affected by CVE-2026-27741?
It affects 1 product.
Products include Bludit Bludit.
How do I fix CVE-2026-27741?
No fix has been published for CVE-2026-27741 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-27741 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-27741 exists.
Other vulnerabilities in Bludit
Sources
Also known as GHSA-xw6c-ffpm-fgcm.