CVE-2024-10578 is a high-severity vulnerability in the blazethemes Pubnews WordPress theme affecting versions up to 1.0.7. The root cause is a missing capability check in the pubnews_importer_plugin_action_for_notice() function, which permits authenticated users with low privileges (Subscriber-level and above) to install arbitrary plugins. This unrestricted upload of dangerous file types (CWE-434) can be leveraged to escalate privileges and execute arbitrary code via malicious plugins. The CVSS 3.1 base score is 8.8, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

An attacker with at least Subscriber-level access can install arbitrary plugins on the affected WordPress site, potentially leading to full site compromise including code execution, data theft, and service disruption. The vulnerability undermines the authorization model of the theme, allowing privilege escalation through plugin installation.

No official patch or fix is currently available as per the provided data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict Subscriber-level access to trusted users only and consider disabling or removing the Pubnews theme if possible. Monitor for updates from blazethemes and apply official patches promptly once available.