The vulnerability CVE-2024-50434 affects the themehorse NewsCard plugin for PHP, versions up to 1.3. It arises from improper validation or control of filenames passed to PHP include or require statements, enabling remote file inclusion. This flaw can be exploited remotely without privileges and requires user interaction, with a high attack complexity. Successful exploitation can lead to full compromise of the affected system, impacting confidentiality, integrity, and availability. No patch or vendor advisory has been provided yet, and no exploits are currently known in the wild.

If exploited, this vulnerability allows remote attackers to execute arbitrary code on the affected system by including malicious remote files. This can lead to complete system compromise, data theft, or service disruption. The CVSS score of 7.5 reflects high impact on confidentiality, integrity, and availability. However, no active exploitation has been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the vulnerable NewsCard plugin or restricting access to affected endpoints to trusted users only. Monitor for updates from themehorse and apply patches promptly once available.