CVE-2024-11391 is an arbitrary file upload vulnerability in the Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution plugin. The issue arises from insufficient validation of uploaded file types in the 'class_fma_connector.php' component, allowing authenticated users with Subscriber-level privileges and explicit permissions to upload potentially dangerous files. This can lead to remote code execution on the server hosting the vulnerable WordPress site. The vulnerability affects all versions up to and including 5.2.10. The CVSS 3.1 base score is 7.5, indicating high severity with network attack vector, high impact on confidentiality, integrity, and availability, and requiring low privileges but high attack complexity.

An attacker with Subscriber-level access and granted permissions by an Administrator can upload arbitrary files to the server, potentially enabling remote code execution. This compromises the confidentiality, integrity, and availability of the affected system. The vulnerability could allow attackers to execute malicious code remotely, leading to full system compromise depending on the server configuration and other security controls.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict permissions carefully to prevent Subscribers from uploading files, and consider disabling or limiting the use of the Advanced File Manager plugin. Monitor for updates from the vendor or plugin author and apply official patches promptly once available.