CVE-2024-11082 is a critical file upload vulnerability in the Tumult Hype Animations WordPress plugin caused by the lack of file type validation in the hypeanimations_panel() function. Authenticated attackers with Author-level privileges or higher can exploit this to upload arbitrary files, potentially enabling remote code execution. The vulnerability affects all versions up to and including 1.9.15. The CVSS v3.1 score is 9.9, reflecting high impact on confidentiality, integrity, and availability. No patch or vendor advisory is currently available, and the plugin is not a cloud service, so remediation depends on the vendor releasing an update.

An attacker with Author-level access or higher can upload arbitrary files to the server, which may lead to remote code execution. This compromises the confidentiality, integrity, and availability of the affected WordPress site. The vulnerability is critical due to the ease of exploitation (network attack vector with low complexity) and the high privileges required (Author-level). No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Author-level access to trusted users only and consider disabling or removing the Tumult Hype Animations plugin if possible. Monitor for updates from the vendor and apply patches promptly once available.