The vulnerability CVE-2024-49668 in Verbalize WP allows an attacker to upload files of dangerous types without restriction. This can include web shells, which enable remote code execution on the affected web server. The issue affects all versions up to 1.0 and requires no authentication or user interaction to exploit. The CVSS score of 10.0 reflects the critical nature of this vulnerability with network attack vector, low attack complexity, no privileges required, no user interaction, and complete confidentiality, integrity, and availability impact.

Successful exploitation can lead to full compromise of the web server hosting Verbalize WP, including remote code execution, data theft, and service disruption. The vulnerability allows attackers to upload malicious files such as web shells, which can be used to control the server remotely.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, it is recommended to disable or remove the Verbalize WP plugin if possible, or restrict file upload permissions and monitor for suspicious uploads. Avoid exposing the affected plugin to untrusted users.