The vulnerability CVE-2024-35629 in Wow-Company's Easy Digital Downloads – Recent Purchases plugin is a PHP Remote File Inclusion issue caused by improper control of filenames in include/require statements. This allows attackers to remotely include malicious PHP code, potentially leading to full system compromise. The issue affects all versions up to 1.0.2. The CVSS 3.1 base score is 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope change, and high impact on confidentiality, integrity, and availability. No patch or official remediation is currently documented.

Successful exploitation of this vulnerability can lead to remote code execution on the affected server, resulting in complete compromise of confidentiality, integrity, and availability of the system running the vulnerable plugin. This could allow attackers to execute arbitrary PHP code, potentially leading to data theft, system manipulation, or denial of service.

No official patch or remediation guidance is currently available from the vendor. Users should monitor Wow-Company's advisories for updates and apply any official fixes once released. Until a patch is available, consider disabling or removing the affected plugin to prevent exploitation. Avoid exposing the vulnerable plugin to untrusted users or networks. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.