The vulnerability CVE-2024-49676 in the Custom Icons for Elementor plugin allows an attacker with high privileges to upload files of dangerous types without restriction. This can lead to the upload of a web shell, which may compromise the confidentiality, integrity, and availability of the affected system. The issue affects versions up to 0.3.3 of the plugin. The CVSS vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, and a scope change with partial impact on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker with high privileges to upload malicious files such as web shells, potentially leading to partial compromise of the affected web server's confidentiality, integrity, and availability. This could enable unauthorized code execution or further attacks on the server environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict plugin usage to trusted administrators only and monitor for suspicious file uploads. Avoid using affected versions of the plugin in production environments if possible.