Pluck 4.7.7-dev2 - PHP Code Execution

Impact

For European organizations, this vulnerability poses a significant threat to web servers running Pluck CMS, especially those hosting sensitive or critical content. Exploitation can lead to unauthorized access, data breaches, website defacement, and lateral movement within corporate networks. Sectors such as education, media, small and medium enterprises, and government agencies using Pluck CMS may experience service disruption and reputational damage. The ability to execute arbitrary PHP code enables attackers to install backdoors, exfiltrate sensitive data, or launch further attacks against internal systems. Since exploitation requires admin credentials, the risk is heightened if credential hygiene is poor or if phishing/social engineering attacks succeed. The vulnerability could also be used to bypass security controls and evade detection. Although rated medium severity, the actual impact could be critical in targeted attacks. European data protection regulations like GDPR impose strict data security requirements, so breaches caused by this vulnerability could result in regulatory penalties and legal consequences. The threat is particularly acute in countries with higher Pluck CMS usage and where attackers focus on web infrastructure as an attack vector.