CVE-2024-10547 is a critical vulnerability in the e-plugins WP Membership WordPress plugin caused by the lack of file type validation in the user_profile_image_upload() function. This allows unauthenticated attackers to upload arbitrary files, which may lead to remote code execution on the server hosting the plugin. The vulnerability affects all versions up to and including 1.6.2. The CVSS 3.1 base score is 9.8, reflecting network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or official fix is currently documented, and the plugin is not a cloud service, so remediation depends on vendor updates or user mitigation.

Successful exploitation allows unauthenticated attackers to upload arbitrary files to the server, which can lead to remote code execution. This compromises the confidentiality, integrity, and availability of the affected system. Given the critical CVSS score of 9.8, the impact is severe and could result in full system compromise if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the vulnerable plugin or restricting file upload capabilities through web server or application-level controls to prevent arbitrary file uploads. Monitoring for suspicious file uploads may help detect exploitation attempts, but no vendor-provided mitigation or patch is currently available.