Pluck CMS is vulnerable to cross-site request forgery, which can be leveraged by an attacker to force an administrator to execute malicious code or compromise the entire system.

This is a cross-site request forgery vulnerability (CWE-352). The application relies solely on the Referer header for CSRF protection, which can be easily bypassed by an attacker by suppressing the header in forged requests.

A successful exploit allows an attacker to perform administrative actions on behalf of a logged-in user, such as installing malicious modules or themes. Given the CVSS score of 9.6, the potential for remote code execution and stored cross-site scripting poses a severe threat to the confidentiality and integrity of the application.

Immediate Action: Update to the latest version of Pluck CMS to implement proper anti-CSRF token mechanisms.

Proactive Monitoring: Monitor for unexpected administrative changes, such as the installation of new modules or unauthorized page modifications, which may indicate a successful CSRF attack.

Compensating Controls: Ensure that administrative users are not browsing untrusted sites while authenticated, and consider implementing stricter HTTP Referrer-Policy headers on the server.

Public Exploit Available: Unknown.

Administrators must update to version 4.7.21 or later to secure the administrative panel. Until an update is applied, administrators should be cautious when accessing the admin panel and ensure they are not simultaneously visiting potentially malicious websites.