CVE-2024-1311 describes an arbitrary file upload vulnerability in the Brizy – Page Builder WordPress plugin, specifically in the storeImages function. The vulnerability arises from the lack of file type validation, allowing authenticated users with contributor or higher privileges to upload potentially dangerous files. This can lead to remote code execution on the server hosting the affected plugin. The issue affects all versions up to and including 2.4.40. The CVSS v3.1 score is 8.8, indicating a high severity vulnerability with network attack vector, low attack complexity, and requiring privileges but no user interaction.

An attacker with contributor or higher access can upload arbitrary files to the server, which may lead to remote code execution. This compromises the confidentiality, integrity, and availability of the affected system. The vulnerability allows full control over the server environment if exploited successfully.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and monitor for suspicious file uploads. Avoid granting unnecessary privileges to users and consider disabling or removing the plugin if not essential.