CVE-2024-2381 is a high-severity vulnerability affecting the AliExpress Dropshipping with AliNext Lite plugin for WooCommerce & WordPress, specifically versions up to 3.3.5. The vulnerability arises from the ajax_save_image function lacking proper file type validation, allowing authenticated users with subscriber-level privileges or higher to upload arbitrary files to the server. This can potentially lead to remote code execution. The vulnerability is categorized as CWE-434, indicating unrestricted upload of files with dangerous types. The CVSS score of 8.8 reflects the ease of exploitation and the impact on confidentiality, integrity, and availability.

An authenticated attacker with subscriber-level access or higher can upload arbitrary files to the server hosting the vulnerable plugin. This can lead to remote code execution, compromising the confidentiality, integrity, and availability of the affected system. The high CVSS score (8.8) reflects the significant risk posed by this vulnerability. There are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user permissions to trusted users only and consider disabling or removing the vulnerable plugin if possible. Monitor official vendor channels for updates and apply any released patches promptly.