CVE-2024-49652: 
WordPress vulnerability analysis and mitigation

The vulnerability (CVE-2024-49652) affects the WordPress 3D Work In Progress plugin versions up to 1.0.3. It is classified as an Unrestricted Upload of File with Dangerous Type vulnerability that allows attackers to upload a Web Shell to a Web Server. The vulnerability was discovered by researcher stealthcopter and was published on October 21, 2024 (Patchstack).

The vulnerability has been assigned a CVSS v3.1 base score of 9.9 (Critical) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. The weakness is categorized as CWE-434 (Unrestricted Upload of File with Dangerous Type). The vulnerability requires Subscriber or higher privileges to exploit (Patchstack).

This vulnerability is considered highly dangerous and is expected to become mass exploited. It allows malicious actors to upload any type of file to the website, including backdoors which can then be executed to gain further access to the website (Patchstack).

Currently, there is no official fix available for this vulnerability. Patchstack has issued a virtual patch to mitigate this issue by blocking any attacks until an official fix becomes available. Website owners are advised to mitigate or resolve the vulnerability immediately (Patchstack).