The vulnerability identified as CVE-2024-49285 affects the SSV MailChimp plugin by Jeroen Berkvens. It is caused by improper limitation of a pathname to a restricted directory, enabling path traversal attacks that lead to PHP Local File Inclusion. This can allow an attacker to include and execute arbitrary local files on the server. The issue affects all versions up to 3.1.5. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker to include and execute arbitrary local files on the server, potentially leading to full compromise of the affected system's confidentiality, integrity, and availability. This could result in unauthorized data access, code execution, or denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the affected plugin, disabling it if possible, or applying temporary mitigations recommended by the vendor once available. Monitor official channels for updates.