Pluck CMS CVE-2026-54416

Exploitation requires two concurrent conditions: (1) the attacker must hold valid administrator credentials for the Pluck CMS instance - unauthenticated exploitation is not possible given the CVSS vector PR:H; and (2) the hosting server must be running PHP 8.x with the web server configured to map the .php8 extension to the PHP interpreter, which is standard on modern PHP 8 deployments. What limits exploitation: administrator authentication is the primary gate, meaning credential theft or insider access is a prerequisite; servers running only PHP 7.x without .php8 handler mappings are not vulnerable to the execution step (the file uploads but does not execute); and the attacker must have network access to the admin panel, which is sometimes restricted by IP allowlist in security-conscious deployments. There is no requirement for any non-default CMS configuration beyond the default file management feature being enabled, which it is by default in Pluck CMS.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H scores 7.2, accurately reflecting that exploitation demands administrator-level authentication - a meaningful barrier that limits opportunistic mass exploitation. Attack complexity is Low once credentials are obtained, and the upload mechanism is network-accessible. EPSS data was not provided in the intelligence input; without it, exploitation probability cannot be quantified. Critically, this is NOT in the CISA KEV catalog and no public proof-of-concept is identified in the provided data, placing it in a lower urgency tier despite the high impact metrics. The real-world risk is principally relevant to environments where admin credentials have been compromised, where insider threat is a concern, or where shared-admin deployments exist (e.g., multi-tenant CMS hosting). The server-side prerequisite of PHP 8.x is not a meaningful constraint given PHP 8.x is the current actively maintained branch and widely deployed. The overall risk profile is: high impact if an attacker reaches admin, but the PR:H requirement keeps automated or unauthenticated exploitation off the table. Organizations running Pluck CMS with multiple or externally accessible admin accounts should treat this as higher priority.

An attacker who has obtained administrator credentials to a Pluck CMS 4.7.21 installation (via credential stuffing, phishing, or a compromised shared-admin account) navigates to the admin file-management interface, uploads a PHP webshell named shell.php8 containing arbitrary PHP code, and then accesses the uploaded file via its public URL. On any server where the PHP 8.x runtime maps the .php8 extension to the PHP handler, the webshell executes with web server process privileges, granting the attacker interactive remote command execution on the underlying host. No public proof-of-concept code has been identified in the provided data, but the attack path is directly derivable from the CVE description.