Arbitrary File Upload and RCE in Pluck CMS via CVE-2023-50564

Pluck CMS version 4.7.18 contains an arbitrary file upload vulnerability (CVE-2023-50564) located in the modules_install.php component. This vulnerability is reachable by an authenticated user with access to the module installation functionality. By interacting with the admin.php?action=installmodule endpoint, an attacker can upload a specially crafted ZIP archive containing a PHP payload. When the system processes the uploaded ZIP file, the included PHP file is saved to the server, allowing the attacker to trigger remote code execution (RCE). As of September 2026, multiple proof-of-concept exploits have been published, significantly lowering the barrier for exploitation. Defenders should restrict access to the administrative dashboard and ensure the instance is patched.

Attack Chain

1. Attacker performs authentication to obtain a valid session cookie for the Pluck CMS administration interface.
2. Attacker navigates to the module installation page at admin.php?action=installmodule.
3. Attacker crafts a ZIP file containing a malicious PHP web shell or payload.
4. Attacker sends an HTTP POST request to the modules_install.php script to upload the crafted ZIP file.
5. The server-side code insecurely extracts the ZIP contents to a directory on the web server.
6. The web server extracts the PHP payload file, potentially into a location accessible to the public web root.
7. Attacker navigates to the URL where the uploaded PHP file is stored.
8. Web server executes the PHP payload, granting the attacker arbitrary code execution on the underlying host.

Impact

Successful exploitation of CVE-2023-50564 results in full remote code execution on the target server. This enables attackers to steal sensitive application data, pivot deeper into the internal network, or deploy additional malware. Given the high CVSS score of 8.8, this flaw poses a critical risk to any infrastructure hosting unpatched versions of Pluck CMS 4.7.18.

Recommendation

• Patch Pluck CMS instances to the latest available version beyond 4.7.18.
• Implement strict access control lists (ACLs) for the admin.php endpoint to prevent unauthorized access by low-privileged users.
• Deploy the provided webserver detection rule to monitor for malicious file upload patterns in application logs.
• Audit the web server's upload directories to identify and remove unauthorized .php or .phtml files.