CVE-2024-10627 is a critical vulnerability in the WooCommerce Support Ticket System WordPress plugin caused by improper validation of uploaded file types in the ajax_manage_file_chunk_upload() function. This allows unauthenticated attackers to upload arbitrary files, potentially enabling remote code execution on the server hosting the plugin. The vulnerability affects all versions up to and including 17.7. The CVSS 3.1 base score is 9.8, reflecting high impact on confidentiality, integrity, and availability with no required privileges or user interaction. No patch or official fix has been released yet, and the plugin is not a cloud service, so remediation depends on vendor updates or user mitigation.

Successful exploitation allows unauthenticated attackers to upload arbitrary files to the affected server, which may lead to remote code execution. This compromises the confidentiality, integrity, and availability of the affected system. Given the critical CVSS score of 9.8, the impact is severe and could result in full system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting the vulnerable plugin functionality to prevent file uploads or implement additional file upload validation controls at the web server or application firewall level. Monitoring for suspicious file uploads may help detect exploitation attempts.