The vulnerability CVE-2024-48034 affects the fliperrr Creates 3D Flipbook, PDF Flipbook plugin, specifically the create-flipbook-from-pdf feature, allowing unrestricted upload of files with dangerous types such as web shells. This can be exploited by an attacker with low privileges to upload malicious files to the web server, potentially leading to complete compromise of the affected system. The issue impacts versions up to and including 1.2. The CVSS 3.1 base score is 9.9, reflecting network attack vector, low attack complexity, no user interaction, privileges required, and complete impact on confidentiality, integrity, and availability. No patch or official remediation guidance is currently provided by the vendor.

Successful exploitation allows an attacker with low privileges to upload arbitrary files, including web shells, to the web server hosting the vulnerable plugin. This can lead to full system compromise, including unauthorized access, data theft, data modification, and service disruption. The vulnerability affects confidentiality, integrity, and availability at a critical level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to restrict or disable the file upload functionality in the fliperrr Creates 3D Flipbook, PDF Flipbook plugin, especially the create-flipbook-from-pdf feature. Limit user privileges to prevent unauthorized uploads and monitor for suspicious activity related to file uploads. Follow vendor updates closely for the release of an official patch.