The vulnerability CVE-2024-50484 affects the Multi Purpose Mail Form plugin by Lindeni Mahlalela, versions up to and including 1.0.2. It allows an attacker to upload files of dangerous types without restriction, including web shells, which can be executed on the web server. This leads to a critical security risk as it can result in full compromise of the affected system. The CVSS 3.1 base score is 10.0, reflecting an attack that can be performed remotely without authentication or user interaction, and that impacts confidentiality, integrity, and availability. No patch or official fix has been documented, and the vulnerability is not related to a cloud service. No known active exploitation has been reported.

Successful exploitation of this vulnerability allows an unauthenticated attacker to upload and execute arbitrary code on the affected web server. This can lead to complete system compromise, including data theft, data modification, service disruption, and further network penetration. The impact is rated critical with full confidentiality, integrity, and availability loss.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to disable or remove the vulnerable Multi Purpose Mail Form plugin if possible. Restrict file upload permissions and monitor web server file upload directories for suspicious files. Avoid exposing the affected plugin to untrusted users. Follow vendor channels closely for updates or patches.