CVE-2024-11617 is a critical vulnerability in the ThemeKalia Envolve Plugin for WordPress that arises from CWE-434: Unrestricted Upload of File with Dangerous Type. The plugin lacks proper file type validation in two upload functions, 'zetra_languageUpload' and 'zetra_fontsUpload', enabling unauthenticated attackers to upload arbitrary files. This can potentially allow remote code execution on the affected WordPress site. The vulnerability affects all versions up to and including 1.0. There is no indication of known exploits in the wild at this time. The CVSS v3.1 base score is 9.8, reflecting network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows unauthenticated attackers to upload arbitrary files to the server hosting the vulnerable WordPress plugin. This can lead to remote code execution, compromising the confidentiality, integrity, and availability of the affected system. Given the critical CVSS score of 9.8, the impact is severe and could result in full system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to disable or remove the Envolve Plugin if possible, or restrict access to the vulnerable upload functions through web application firewall rules or other access controls to prevent unauthenticated uploads.