The move_plugin endpoint in django CMS accepts an attacker‑controlled plugin_parent value without rejecting a self‑reference or descendant reference, allowing a staff user with plugin‑change permission to create a cycle in the plugin tree. Subsequent calls to get_descendants() during rendering, copying, or deletion recurse without a guard, causing infinite recursion or a database recursion limit. The corrupted tree and exhausted request workers result in a denial of service.

All installations of django CMS prior to version 5.0.8 are affected. Any instance where a staff user has the CMS_PERMISSION role and plugin‑change rights can exploit the flaw; the issue does not apply to later releases or to environments lacking the relevant permission set.

The CVSS score of 7.1 indicates a medium severity risk. EPSS is not available, and the vulnerability is not listed in CISA’s KEV catalog. An attacker must have staff‑level CMS access and an ability to invoke the move_plugin endpoint to craft a cyclic relationship. Once triggered, the resulting recursion can overload application workers and degrade service availability. No public exploits are documented, but the high resource‑consumption potential warrants prompt remediation.