Pluck CMS up to version 4.7.21 implements file upload restrictions in its admin file-management feature by using a fixed blacklist of dangerous file extensions in data/inc/files.php. The blacklist includes extensions such as '.php', 'php3', 'php4', 'php5', 'php6', 'php7', 'phtml', '.phtm', '.pht', '.ph3', '.ph4', '.ph5', '.asp', '.cgi', and '.phar'. However, the check is performed only against the last 4-5 characters of the filename, which can be circumvented to upload files with dangerous types. This constitutes an unrestricted file upload vulnerability (CWE-434) that can lead to high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can allow an attacker with administrative privileges to upload files with dangerous types despite the blacklist, potentially leading to remote code execution, data compromise, or service disruption. The CVSS score of 7.2 reflects high impact on confidentiality, integrity, and availability. There are no known exploits in the wild as of the publication date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is provided in the available data. Administrators should monitor vendor communications for updates and consider restricting file upload capabilities or implementing additional file validation controls until a patch is available.