The WP REST API FNS plugin version 1.0.0 and earlier contains an unrestricted file upload vulnerability that permits attackers to upload files of dangerous types, such as web shells, to the server. This vulnerability can be exploited remotely without authentication or user interaction, resulting in full compromise of the affected system. The vulnerability is tracked as CVE-2024-49329 and carries a CVSS 3.1 base score of 10.0 (critical). No patch or official remediation details have been provided in the available data.

Successful exploitation allows an unauthenticated attacker to upload and execute arbitrary code on the affected server, leading to complete compromise of confidentiality, integrity, and availability of the system. This can result in unauthorized access, data theft, service disruption, and potential use of the server for further attacks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to disable or remove the WP REST API FNS plugin to prevent exploitation. Monitor for updates from the vendor or trusted security sources for patch releases.