The vulnerability CVE-2024-50482 affects the Woocommerce Product Design plugin by Chetan Khandla, allowing unrestricted upload of files with dangerous types, such as web shells, without authentication. This enables remote attackers to execute arbitrary code on the web server by uploading malicious files. The issue impacts versions up to and including 1.0.0. The CVSS 3.1 base score is 10.0, reflecting critical severity with network attack vector, no required privileges or user interaction, and full impact on confidentiality, integrity, and availability. No patch or mitigation details are currently provided by the vendor or in public advisories.

Successful exploitation allows remote attackers to upload and execute arbitrary code on the affected web server, leading to complete compromise of the system, including full confidentiality, integrity, and availability loss. This can result in unauthorized access, data theft, defacement, or service disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to disable or remove the affected Woocommerce Product Design plugin if possible. Additionally, restrict file upload permissions and implement web application firewall (WAF) rules to block suspicious upload attempts as temporary mitigations.