The vulnerability CVE-2024-49607 affects the redhopit WP Dropbox Dropins WordPress plugin up to version 1.0. It allows unauthenticated attackers to upload files of dangerous types without restriction, including web shells, which can be executed on the server. This results in a critical security risk with full system compromise potential. The CVSS v3.1 base score is 10.0, reflecting network attack vector, no privileges required, no user interaction, and complete impact on confidentiality, integrity, and availability. No official patch or fix has been published, and the plugin is not a cloud service, so remediation depends on vendor updates or user action.

Successful exploitation allows attackers to upload and execute arbitrary code on the affected web server, leading to full compromise of confidentiality, integrity, and availability of the system. This can result in data theft, defacement, service disruption, or use of the server for further attacks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, it is recommended to disable or remove the vulnerable WP Dropbox Dropins plugin to prevent exploitation. Monitor official vendor channels for updates and apply patches as soon as they are released.