The vulnerability identified as CVE-2024-27951 (CWE-434) in the Themeisle Multiple Page Generator Plugin – MPG allows an attacker with high privileges to upload files of dangerous types without restriction. This can include web shells, which can be used to execute arbitrary code on the web server. The issue affects all versions up to 3.4.0. The CVSS v3.1 score is 9.1, indicating a critical severity with network attack vector, low attack complexity, no user interaction, and impacts on confidentiality, integrity, and availability. No official patch or remediation level has been published by the vendor as of the data provided.

Successful exploitation allows an attacker with high privileges to upload malicious files such as web shells to the server, potentially leading to full system compromise including unauthorized code execution, data theft, and service disruption. The vulnerability affects confidentiality, integrity, and availability of the affected system, making it critical in severity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict plugin usage to trusted administrators only and consider disabling or removing the plugin if not essential. Monitor for suspicious file uploads and web shell activity as a temporary mitigation.