Pluck CMS EUVD-2026-53196

Exploitation requires that a victim administrator is authenticated to the Pluck admin panel and, during that active session, visits an attacker-controlled web page - the UI:R user-interaction prerequisite. The attacker page must suppress the HTTP Referer header (e.g. via <meta name=referrer content=no-referrer> or a no-referrer Referrer-Policy) so that requestedByTheSameDomain() in data/inc/functions.admin.php hits its elseif branch and returns true; this is the concrete mechanism, not a configuration option, and works against default installations since Pluck ships no anti-CSRF tokens. Limiting factors: the admin must have a live authenticated session, must be induced to load the malicious page, and the admin panel must be reachable from the victim's browser - IP-restricted or VPN-gated admin panels and SameSite=Strict session cookies materially reduce exploitability.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H = 9.6 Critical) is internally consistent with a CSRF-to-RCE chain: network vector, low complexity, no attacker privileges, but required user interaction (a logged-in admin must visit the attacker page) and a scope change because injected modules execute as server-side PHP. The PR:N reflects that the attacker holds no privileges - the victim supplies the authenticated session - so this is not an authentication bypass but a session-riding attack. No EPSS score, SSVC decision, or KEV entry was supplied; exploitation status is 'no public exploit identified at time of analysis,' so real-world exploitation is unproven despite the high score. The key limiting factor is UI:R: exploitation depends on socially engineering an authenticated administrator, which favors targeted rather than mass exploitation. This is a genuine priority for any internet-exposed Pluck admin panel, but the UI:R dependency tempers it below a wormable, zero-interaction critical.

An attacker crafts a web page containing an auto-submitting form (or fetch) targeting admin.php with a no-referrer policy, then lures a currently-logged-in Pluck administrator to visit it via phishing or a malicious link. The victim's browser silently submits the forged request with no Referer, the fail-open check accepts it, and the attacker installs a malicious PHP module to gain remote code execution or creates a page with raw HTML for stored XSS. No public POC is currently identified, but the bypass technique is trivial to reproduce.