CVE-2024-11613 is a critical vulnerability in the nickboss WordPress File Upload plugin (Iptanus File Upload) affecting all versions up to 4.24.15. The issue stems from insufficient sanitization of the 'source' parameter in 'wfu_file_downloader.php', which permits unauthenticated attackers to control directory paths. This flaw enables remote code execution, arbitrary file reading, and deletion on the server hosting the plugin. The vulnerability is categorized as CWE-94, indicating improper control over code generation. The CVSS 3.1 base score is 9.8, reflecting high impact on confidentiality, integrity, and availability. No patch or official fix is currently documented, and the plugin is not a cloud service, so remediation depends on vendor updates or user action.

Successful exploitation allows unauthenticated attackers to execute arbitrary code remotely, read arbitrary files, and delete files on the server running the vulnerable plugin. This compromises the confidentiality, integrity, and availability of the affected system. Given the critical CVSS score of 9.8, the impact is severe and could lead to full system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix is currently documented, users should monitor vendor communications for updates. Until a fix is available, consider disabling or removing the vulnerable plugin to prevent exploitation. Avoid exposing the affected functionality to untrusted users.