CVE-2021-31745: Pluck-CMS Pluck

High severity, CVSS 7.5. EPSS: 1.2% chance of exploitation in the next 30 days.

Session Fixation vulnerability in login.php in Pluck-CMS Pluck 4.7.15 allows an attacker to sustain unauthorized access to the platform. Because Pluck does not invalidate prior sessions after a password change, access can be sustained even after an administrator performs regular remediation attempts such as resetting their password.

Affected products

• Pluck-CMS Pluck: version 4.7.15 only

Published 2021-12-10. Last modified 2026-06-17.