CVE-2024-1205 is an arbitrary file upload vulnerability in the Management App for WooCommerce – Order notifications, Order management, Lead management, Uptime Monitoring WordPress plugin. The issue arises from the lack of proper file type validation in the nouvello_upload_csv_file function, allowing authenticated users with subscriber-level privileges or higher to upload potentially dangerous files. This could enable remote code execution on the server hosting the affected plugin. The vulnerability affects all versions up to and including 1.2.2. There is no vendor-provided patch or advisory currently available.

An attacker with subscriber-level access or above can upload arbitrary files to the server, which may lead to remote code execution. This compromises the confidentiality, integrity, and availability of the affected system. Given the high CVSS score (8.8), the impact is significant, potentially allowing full system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber-level user permissions where possible and monitor for suspicious file uploads. Consider disabling or limiting the use of the vulnerable upload functionality if feasible.