TextPattern CMS versions include a flaw that lets attackers, once authenticated, upload arbitrary PHP files by leveraging the plugin upload feature. The vulnerability is realized by retrieving a CSRF token from the plugin event page, then submitting a malicious file to the textpattern/tmp/ directory. The resulting file execution grants the attacker remote code execution privileges on the server, effectively enabling full compromise of the affected site. The weakness is identified as a Cross‑Site Request Forgery (CWE‑352).

The affected product is TextPattern CMS. All developmental, beta, and stable releases of version 4.9.0 are impacted, including 4.9.0‑dev, 4.9.0, 4.9.0‑beta, 4.9.0‑beta1, 4.9.0‑beta1a, and 4.9.0‑beta2.

The CVSS score of 8.7 suggests a high severity vulnerability with complete impact on confidentiality, integrity, and availability. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a valid authenticated session and the ability to request the CSRF token, indicating that the primary attack vector is via a web interface using authenticated credentials. The presence of a proof‑of‑concept may increase the likelihood of exploitation in the wild.