This vulnerability affects MacCMS Pro up to version 2022.1.3 and allows an attacker with high privileges to perform unrestricted file uploads via the Plugin Installation Handler's install function located at /admi.php/admin/addon/add.html. The vulnerability can be exploited remotely without user interaction and has a CVSS 4.0 score of 5.1, indicating medium severity. The vendor was contacted but did not provide a response or patch, and no official remediation level is assigned. Public exploit code has been released, increasing the risk of potential attacks.

Successful exploitation could allow an attacker with high privileges to upload arbitrary files to the server, potentially leading to further compromise or unauthorized actions. The vulnerability does not require user interaction and can be triggered remotely. However, exploitation requires the attacker to have high privileges on the system. There are no confirmed reports of exploitation in the wild.

No official patch or remediation is currently available from the vendor, and the vendor has not responded to the disclosure. Users should monitor vendor communications for any updates. Until a fix is released, restricting access to the affected component and limiting high privilege accounts may reduce risk. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.