Pluck CMS up to version 4.7.21 enforces a hard‑coded blacklist of disallowed file extensions when an administrator uploads files through the file‑management interface. The list includes common PHP extensions such as .php, .php5, and .phtml, but it fails to block the .php8 extension. An attacker with administrative credentials can upload a file named for example shell.php8, which the system stores unchanged. On servers running PHP 8.x, the web server executes .php8 files as PHP, giving the attacker arbitrary code execution. This flaw is a typical example of the "Unrestricted Upload of File with Dangerous Type" weakness (CWE‑434).

The vulnerability affects users of Pluck CMS version 4.7.21 or earlier. The product name is Pluck CMS 4.7.21, and the problem exists in the files/inc/files.php blacklist logic. Administrators of newer releases that address the .php8 omission are not impacted.

The CVSS score of 7.2 indicates a moderate to high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires an authenticated administrator; the attacker must have legitimate admin access to the CMS and the web server must be running PHP 8.x for the uploaded file to be executed. Given that only administrators can exploit the flaw, the exploitation likelihood is limited to environments where admin privileges are compromised or used maliciously. The consequence of successful exploitation is full remote code execution on the affected server.