The vulnerability CVE-2024-50435 affects the themehorse Meta News plugin for WordPress, specifically versions up to 1.1.7. It arises from improper validation or control of filenames used in PHP include or require statements, enabling remote file inclusion (RFI). This can allow an unauthenticated attacker who can trick a user into interacting with a crafted request to include and execute remote malicious code on the server. The CVSS 3.1 score is 7.5 (high), reflecting network attack vector, high attack complexity, no privileges required, user interaction required, and full impact on confidentiality, integrity, and availability.

Successful exploitation can lead to remote code execution on the affected server, compromising the confidentiality, integrity, and availability of the system running the Meta News plugin. This could allow attackers to execute arbitrary code, potentially leading to full system compromise. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the Meta News plugin if feasible, and restrict access to the affected system to trusted users only. Monitor vendor channels for updates and apply patches promptly once available.