The vulnerability CVE-2024-39624 in ListingPro by CridioStudio arises from improper limitation of pathnames to restricted directories, enabling path traversal attacks. This can lead to PHP Local File Inclusion, allowing an attacker with low privileges and no user interaction to potentially execute arbitrary code or access sensitive files. The issue affects all versions up to 2.9.4. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) reflects network attack vector, high attack complexity, low privileges required, no user interaction, and complete impact on confidentiality, integrity, and availability. No patch or official fix has been disclosed yet.

Successful exploitation could allow an attacker to include and execute arbitrary PHP files on the server, leading to full compromise of the affected system's confidentiality, integrity, and availability. This could result in unauthorized data access, code execution, and potential service disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to vulnerable endpoints, applying web application firewall rules to detect and block path traversal attempts, and limiting privileges of the web server process to minimize impact.