This vulnerability (CVE-2024-13418) affects multiple plugins and themes using the G5Theme Benaa Framework for WordPress. The ajaxUploadFonts() function lacks proper capability checks, allowing authenticated users with low privileges (Subscriber and above) to upload arbitrary files. This can enable remote code execution if malicious files are uploaded and executed. Although the issue was escalated to Envato and partially patched, the vulnerability persists in some form. No official patch links are provided, and the vendor advisory status is not available, so patch status remains unconfirmed.

Successful exploitation allows an authenticated user with minimal privileges to upload arbitrary files, which can lead to remote code execution. This compromises the confidentiality, integrity, and availability of the affected WordPress site. Given the high CVSS score (8.8), the impact is significant, potentially allowing attackers to fully control the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the issue is partially patched but still vulnerable, administrators should monitor for updates from G5Theme or Envato. Until a full fix is available, restrict user privileges and consider disabling or removing the affected ajaxUploadFonts() functionality if possible to reduce risk.