Wooyin

**Name of the Vulnerable Software and Affected Versions** Pluck CMS versions 4.7.10-dev2 through 4.7.11 **Description** The issue is related to a file upload vulnerability that can lead to remote command execution. This can be achieved via the "admin.php?action=files" endpoint. The vulnerability allows for potential exploitation, but specific details about the number of affected devices or real-world incidents are not provided. **Recommendations** For Pluck CMS versions 4.7.10-dev2 through 4.7.11, consider disabling the file upload functionality via the "admin.php?action=files" endpoint until a patch is available. Restrict access to this endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.