This vulnerability allows an authenticated administrator user of PluXml CMS to overwrite the minify.php file in the default theme directory with arbitrary PHP code through the admin panel. This leads to remote code execution (RCE), enabling the attacker to execute system commands on the affected server. The issue stems from improper access control and unsafe file handling in the theme editor component. The CVSS 3.1 base score is 9.1, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and complete impact on confidentiality, integrity, and availability.

Successful exploitation results in full remote code execution on the server hosting PluXml CMS, compromising system confidentiality, integrity, and availability. An attacker with administrator privileges can execute arbitrary system commands, potentially leading to complete system takeover.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted personnel only and monitor for suspicious activity related to theme file modifications. Avoid using the vulnerable theme editor functionality if possible.