The vulnerability CVE-2024-50493 affects the Automatic Translation plugin by masterhomepage, allowing attackers to upload files of dangerous types without restriction. This can be exploited to upload a web shell, granting remote code execution capabilities on the affected web server. The issue impacts versions up to and including 1.0.4. The CVSS 3.1 base score is 10.0, reflecting an attack vector over the network with no required privileges or user interaction, and complete compromise of confidentiality, integrity, and availability. No patch or vendor advisory is currently provided, and the product is not a cloud service.

Successful exploitation allows an unauthenticated attacker to upload a web shell to the target server, resulting in full remote code execution. This can lead to complete system compromise, data theft, data modification, and denial of service. Given the critical CVSS score and the nature of the vulnerability, the impact is severe.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict or disable file upload functionality in the Automatic Translation plugin if possible. Implement web application firewall (WAF) rules to detect and block malicious file uploads targeting this vulnerability. Monitor for suspicious activity related to file uploads and web shell execution.