This vulnerability (CVE-2024-30500) in CubeWP – All-in-One Dynamic Content Framework allows unrestricted upload of files with dangerous types, which can lead to critical impacts including full confidentiality, integrity, and availability compromise. The CVSS 3.1 base score is 9.9, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and scope change. The affected versions include all versions up to 1.1.12. No patch or official remediation level has been provided yet.

Successful exploitation can result in complete system compromise, including unauthorized disclosure, modification, or destruction of data, and disruption of service. The vulnerability is critical due to its high CVSS score and potential for severe impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict file upload permissions and validate file types rigorously where possible as a temporary measure. Avoid granting unnecessary privileges to users who can upload files.