Pluck CMS versions up to 4.7.21 restrict file uploads on the admin interface by checking a static blacklist in data/inc/files.php. The list contains many common PHP extensions—such as .php, .php3, .php4, .php5, .php6, .php7, .phtml, .phtm, .pht, .ph3, .ph4, .ph5, .asp, .cgi, .phar—and the comparison uses only the last four to five characters of the filename. Because the .php8 extension is not part of this blacklist, an attacker who can access the CMS administration can upload a file named, for example, exploit.php8. On a server running PHP 8.x the web server will treat this file as a PHP script and execute it, yielding arbitrary code execution. This vulnerability exemplifies CWE‑434, Unrestricted Upload of File with Dangerous Type.

The vulnerability affects users of Pluck CMS version 4.7.21 or earlier. The product name is Pluck CMS 4.7.21, and the problem exists in the files/inc/files.php blacklist logic. Administrators of newer releases that address the .php8 omission are not impacted.

The CVSS score of 7.2 indicates a moderate to high severity. The EPSS score is <1%, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires an authenticated administrator; the attacker must have legitimate admin access to the CMS and the web server must be running PHP 8.x for the uploaded file to be executed. Given that only administrators can exploit the flaw, the exploitation likelihood is limited to environments where admin privileges are compromised or used maliciously. The consequence of successful exploitation is full remote code execution on the affected server.