The vulnerability CVE-2024-48027 affects the xaraartech External featured image from bing plugin (up to version 1.0.2). It permits an attacker with low privileges to upload files without proper restriction on file types, including potentially malicious web shells. This can lead to full compromise of the web server, impacting confidentiality, integrity, and availability. The CVSS 3.1 base score is 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and complete system compromise. No patch or fix information is currently available from the vendor or advisory sources.

Successful exploitation allows an attacker to upload a web shell to the affected server, resulting in complete compromise of confidentiality, integrity, and availability of the system. This can lead to unauthorized access, data theft, data manipulation, and denial of service. The vulnerability is critical due to the ease of exploitation and the severe impact on the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected plugin and consider disabling or removing it if possible. Monitor for suspicious file uploads and unauthorized access attempts related to this plugin. Avoid exposing the affected service to untrusted users.