CVE-2022-26965: Pluck-CMS Pluck

High severity, CVSS 7.2. EPSS: 36.3% chance of exploitation in the next 30 days.

In Pluck 4.7.16, an admin user can use the theme upload functionality at /admin.php?action=themeinstall to perform remote code execution.

Affected products

• Pluck-CMS Pluck: version 4.7.16 only

Published 2022-03-18. Last modified 2026-06-17.