The vulnerability CVE-2024-49281 in Ninja Team's Click to Chat – WP Support All-in-One Floating Widget plugin is due to improper neutralization of special elements used in OS commands, leading to OS Command Injection. This can allow an attacker with limited privileges to execute arbitrary OS commands via crafted input. The affected versions include all versions up to 2.3.3. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, required privileges, user interaction, and partial impact on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker with some privileges and user interaction to execute arbitrary OS commands on the affected system, potentially leading to partial compromise of confidentiality, integrity, and availability of the system running the vulnerable plugin. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, limit user privileges and avoid exposing the vulnerable plugin to untrusted users. Monitor for updates from Ninja Team regarding patches or mitigations.