The vulnerability CVE-2024-48035 affects the takayukii ACF Images Search And Insert plugin up to version 1.1.4. It permits an attacker with low privileges to upload files without proper restrictions on file types, including potentially malicious web shells. This unrestricted file upload can be exploited to execute arbitrary code on the server, resulting in full system compromise. The CVSS score of 9.9 reflects the critical nature of this vulnerability, with network attack vector, low attack complexity, no user interaction required, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker to upload and execute arbitrary code on the web server, leading to full compromise of the affected system. This includes the ability to steal data, modify or delete content, and disrupt service availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the plugin functionality to trusted users only and consider disabling or removing the plugin if possible to prevent exploitation.