The vulnerability identified as CVE-2024-31377 in WP Photo Album Plus allows unrestricted upload of files with dangerous types, classified under CWE-434. This means the plugin does not properly restrict or validate file types during upload, potentially enabling attackers to upload malicious files such as web shells or scripts. The issue affects versions up to 8.7.01.001. The vulnerability has a CVSS 3.1 base score of 10.0, reflecting its critical nature with network attack vector, no privileges or user interaction required, and complete compromise of confidentiality, integrity, and availability. No patch or official remediation level has been published yet, and the affected product is not a cloud service, so remediation depends on vendor updates or user action.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to upload and execute malicious files on the affected system, leading to full system compromise including confidentiality, integrity, and availability impacts. This could result in unauthorized access, data theft, data manipulation, or denial of service. The critical CVSS score reflects the high impact and ease of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting file upload functionality in WP Photo Album Plus or applying custom file type validation controls. Monitoring for suspicious file uploads and restricting web server execution permissions on upload directories may reduce risk. Follow the vendor’s updates closely for an official patch or mitigation.