Pluck CMS through version 4.7.21 restricts dangerous file uploads in its admin file-management feature using a fixed blacklist of file extensions checked against the last 4-5 characters of the filename. The blacklist includes many PHP-related extensions but omits the '.php8' extension. An authenticated administrator can exploit this by uploading a file named with the '.php8' extension (e.g., shell.php8). On servers running PHP 8.x, such files are executed as PHP scripts by the web server, resulting in remote code execution.

Successful exploitation allows an authenticated administrator to upload and execute arbitrary PHP code on the server, leading to full compromise of the affected system. This impacts confidentiality, integrity, and availability of the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should avoid uploading files with the '.php8' extension and consider additional server-side restrictions to block execution of such files. Monitoring and restricting administrator access can also reduce risk.