CVE-2024-10590 is a file upload vulnerability in the Opt-In Downloads WordPress plugin by halfdata. The admin_upload() function lacks proper validation of uploaded file types, allowing authenticated users with low privileges (Subscriber and above) to upload arbitrary files. This flaw can be exploited to achieve remote code execution on NGINX servers due to the presence of an .htaccess file that restricts exploitation on other server types. The vulnerability affects all versions up to and including 4.07. The CVSS 3.1 score is 8.8, indicating a high severity with network attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability.

An attacker with Subscriber-level access or higher can upload arbitrary files to the server hosting the vulnerable plugin. This can lead to remote code execution on NGINX web servers, potentially allowing full compromise of the affected site. The vulnerability impacts confidentiality, integrity, and availability of the system. Exploitation on other web servers is limited by the presence of an .htaccess file. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user permissions to prevent untrusted users from uploading files. Monitor for plugin updates from halfdata and apply them promptly once available. Consider disabling or removing the Opt-In Downloads plugin if it is not essential.