CVE-2020-18198: 
Pluck CMS vulnerability analysis and mitigation

Cross Site Request Forgery (CSRF) vulnerability exists in Pluck CMS v4.7.9 that allows remote attackers to execute arbitrary code and delete specific images via the component '/admin.php?action=images'. The vulnerability was discovered and disclosed in February 2019 (Github Issue).

The vulnerability has been assigned a CVSS v3.1 Base Score of 8.8 HIGH (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). The issue is classified as CWE-352 (Cross-Site Request Forgery). The vulnerability exists in the admin interface and affects multiple components including image management, theme management, module management, and page management functionalities (NVD).

A successful exploitation of this vulnerability could allow attackers to perform unauthorized actions including deletion of images, themes, modules, and pages when an authenticated administrator visits a malicious webpage. This can lead to significant disruption of the CMS functionality and potential loss of content (Github Issue).

The vulnerability requires user interaction where an authenticated administrator needs to visit a maliciously crafted webpage. The attack can be executed through specially crafted iframes that trigger unauthorized actions on the CMS admin interface (Github Issue).

Security recommendations include implementing proper CSRF protections such as: 1) Adding CSRF tokens for authentication of requests, 2) Implementing referer header checks, 3) Using POST method instead of GET for modification operations, and 4) Adding verification codes for sensitive operations (Github Issue).