CVE-2025-57567
CriticalCVSS 9.1Exploitation Probability (EPSS)
Elevated risk53th percentile - higher than 53% of all known CVEs
Summary
A remote code execution (RCE) vulnerability exists in the PluXml CMS theme editor, specifically in the minify.php file under the default theme directory. An authenticated administrator can overwrite this file with arbitrary PHP code via the admin panel.
Risk Assessment
An attacker with admin privileges can execute arbitrary system commands, leading to full server compromise and data breach.
Recommendation
Update PluXml CMS to the latest version immediately, restrict admin privileges to trusted users, and protect the minify.php file from unauthorized writes.
Other vulnerabilities in PluXml CMS
See all- CVE-2026-24352Critical
PluXml CMS allows a user's session identifier to be set before authentication, enabling an attacker to hijack the session after authentication. The session ID remains unchanged after authentication, creating a risk of session takeover.
- CVE-2025-67436Medium
Authenticated Remote Code Execution (RCE) in PluXml CMS 5.8.22 allows an attacker with administrator panel access to inject a malicious PHP webshell into a theme file (e.g., home.php).
Original NVD description (English source)
A remote code execution (RCE) vulnerability exists in the PluXml CMS theme editor, specifically in the minify.php file located under the default theme directory (/themes/defaut/css/minify.php). An authenticated administrator user can overwrite this file with arbitrary PHP code via the admin panel, enabling execution of system commands.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS