The vulnerability in Pluck CMS lies in its admin panel’s authentication guard, which relies solely on a Referer-header comparison for CSRF protection and provides no per‑request anti‑CSRF token. This weakness enables an attacker to send forged requests that bypass CSRF safeguards, allowing malicious creation of pages with arbitrary HTML—leading to stored cross‑site scripting—and upload of PHP modules or themes, which can result in remote code execution. The vulnerability conforms to CWE‑352, a lack of proper origin validation.

All deployed installations of Pluck CMS that expose the admin interface are affected, regardless of major version, because the flaw resides in the shared admin.php gating code. Any site running Pluck CMS with an enabled admin panel faces this risk, and no version‑specific exclusions are documented.

The CVSS score of 9.6 indicates that an attacker could compromise confidentiality, integrity, and availability through this route. The EPSS score of 0.00193 indicates that the exploitation probability is low, but the very low effort required—suppressing a referer header via an attacker‑controlled page—means the vulnerability is still likely exploitable. The vulnerability has not yet been listed in the CISA KEV catalog. The likely attack vector is a simple web page hosted on a malicious domain that suppresses the referer header to force an authenticated administrator’s browser to perform privileged actions within the CMS, granting the attacker arbitrary code execution on the backend.