Pluck CMS 4.7.20-dev contains a critical vulnerability allowing authenticated users to achieve remote command execution via improper file handling.

The vulnerability exists within the albums module where an authenticated attacker can upload a crafted PHP file and execute it through the module routing logic in albums.site.php. This requires the attacker to possess authenticated access to the system.

The ability to execute arbitrary commands on the server poses a significant risk to the integrity and confidentiality of the entire hosting environment. Given the CVSS score of 7.1, this flaw is categorized as high severity because it enables unauthorized code execution, which could lead to full system compromise, data theft, or lateral movement within the network.

Immediate Action: Administrators should restrict access to the CMS administrative interface and ensure that file upload permissions are strictly limited to trusted users while awaiting a vendor-supplied patch.

Proactive Monitoring: Security teams should monitor web server access logs for requests directed at the albums module directory, specifically looking for unusual file extensions or unexpected HTTP GET parameters.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block unauthorized attempts to upload or execute files within the albums module path.

Public Exploit Available: Yes — a public proof-of-concept exists in the GitHub repository maintained by 0xC4J.

Due to the high risk associated with remote command execution, administrators must prioritize the security of the Pluck CMS installation. If an immediate update is not available, implement strict access controls and monitor logs for suspicious activity to mitigate the risk of exploitation.