CVE-2024-49611: 
WordPress vulnerability analysis and mitigation

The vulnerability (CVE-2024-49611) affects the Product Website Showcase WordPress plugin versions up to 1.0. It was discovered by researcher stealthcopter and publicly disclosed on October 17, 2024. The vulnerability is classified as an Unrestricted Upload of File with Dangerous Type, which allows unauthorized users to upload a web shell to a web server (Patchstack).

The vulnerability has received a Critical severity rating with a CVSS v3.1 base score of 9.8 (NIST) and 10.0 (Patchstack). The CVSS vector string is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating that the vulnerability can be exploited remotely with low attack complexity, requires no privileges or user interaction, and can result in high impacts to confidentiality, integrity, and availability. The vulnerability is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type) (NVD).

This vulnerability is considered highly dangerous and is expected to become mass exploited. It allows malicious actors to upload any type of file to the affected website, including backdoors which can then be executed to gain further access to the website. The vulnerability poses significant risks to website security and could lead to complete system compromise (Patchstack).

The vulnerability is particularly concerning as it can be exploited without authentication, meaning any remote attacker can potentially exploit it. The low attack complexity and lack of required privileges make this vulnerability highly exploitable (Patchstack).

Currently, no official fix is available for this vulnerability. Patchstack has issued a virtual patch to mitigate this issue by blocking any attacks until an official fix becomes available. Website administrators are advised to implement immediate mitigation measures or consider using Patchstack's protection (Patchstack).