CVE-2024-4397 is an unrestricted file upload vulnerability in the LearnPress WordPress LMS Plugin for creating and selling online courses. The flaw exists because the 'save_post_materials' function does not validate file types properly, allowing authenticated users with Instructor or higher privileges to upload arbitrary files. This can lead to remote code execution if malicious files are uploaded and executed on the server. The vulnerability affects versions up to and including 4.2.6.5. The CVSS 3.1 base score is 8.8, reflecting network attack vector, low attack complexity, required privileges at the Instructor level, no user interaction, and high impact on confidentiality, integrity, and availability.

An attacker with Instructor-level permissions or higher can upload arbitrary files to the server hosting the LearnPress plugin, potentially enabling remote code execution. This compromises the confidentiality, integrity, and availability of the affected system. The vulnerability allows an authenticated user to bypass file type restrictions, which could lead to full system compromise depending on the server configuration and execution environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict Instructor-level permissions to trusted users only and consider disabling file upload functionality if feasible. Monitor for updates from the plugin vendor (thimpress) and apply official fixes promptly once released.