CVE-2020-29607

CVE-2020-29607 is a high-severity file upload restriction bypass vulnerability affecting Pluck CMS versions prior to 4.7.13, which allows an authenticated administrator to upload malicious files through the "manage files" functionality. With a CVSS score of 7.2 (High), this flaw enables an attacker with high privileges to achieve remote code execution, potentially leading to full compromise of the host system with low attack complexity. Although not listed in CISA's Known Exploited Vulnerabilities catalog, a public exploit for authenticated remote code execution is available on ExploitDB, and the vulnerability is on the "Hot List: Active" indicating ongoing attention.