CVE-2024-49291: 
WordPress vulnerability analysis and mitigation

The vulnerability (CVE-2024-49291) affects the WordPress Cooked Pro plugin versions before 1.8.0. It was discovered and disclosed on October 15, 2024, and is classified as an Unrestricted Upload of File with Dangerous Type vulnerability in Gora Tech LLC's Cooked Pro plugin (Patchstack).

The vulnerability has been assigned a CVSS v3.1 base score of 10.0 (Critical) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. It is categorized under CWE-434 (Unrestricted Upload of File with Dangerous Type) (NVD).

This vulnerability allows malicious actors to upload any type of file to the affected website, including potential backdoors that can be executed to gain further access to the website. The critical CVSS score of 10.0 indicates the highest possible severity level, suggesting severe potential consequences if exploited (Patchstack).

Users are advised to update to Cooked Pro version 1.8.0 or later to resolve this vulnerability. Patchstack has issued a virtual patch to mitigate this issue by blocking any attacks until users can update to a fixed version (Patchstack).