The WordPress File Upload plugin (Iptanus File Upload) contains a critical vulnerability (CVE-2024-11635) classified as CWE-94 (Improper Control of Generation of Code). This vulnerability allows unauthenticated remote attackers to execute arbitrary code on the server by manipulating the 'wfu_ABSPATH' cookie parameter. It affects all versions up to and including 4.24.12. The vulnerability has a CVSS 3.1 base score of 9.8, reflecting its critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability. No patch or official fix details are currently provided, and the product is not a cloud service, so remediation is the responsibility of the site administrators.

Successful exploitation of this vulnerability allows unauthenticated attackers to execute arbitrary code on the affected server, potentially leading to full system compromise. This impacts confidentiality, integrity, and availability of the affected system. There are no known exploits in the wild reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to disable or remove the vulnerable plugin to prevent exploitation. Monitor vendor channels for updates and apply patches promptly once released.