The vulnerability CVE-2024-50523 affects RainbowLink Inc.'s All Post Contact Form plugin, allowing unrestricted upload of files with dangerous types through its contact form functionality. This flaw permits attackers to upload web shells to the server, potentially enabling remote code execution and full compromise of the affected system. The vulnerability affects all versions up to and including 1.8.2. The CVSS 3.1 base score is 10.0, reflecting critical severity with network attack vector, no required privileges or user interaction, and complete impact on confidentiality, integrity, and availability. No patch or official vendor advisory is currently available, and the product is not a cloud service.

Successful exploitation allows an unauthenticated attacker to upload arbitrary files, including web shells, to the web server hosting the vulnerable plugin. This can lead to remote code execution, full system compromise, data theft, data modification, and denial of service. The vulnerability has a critical CVSS score of 10.0, indicating maximum impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, restrict access to the vulnerable plugin, disable file upload functionality if possible, and monitor for suspicious activity related to file uploads. Avoid exposing the contact form to untrusted users. Follow up with RainbowLink Inc. for updates on patches or mitigations.