The vulnerability CVE-2024-50526 affects the Multi Purpose Mail Form plugin by Lindeni Mahlalela, allowing unauthenticated attackers to upload files of dangerous types without restriction. This unrestricted file upload can be exploited to place a web shell on the server, potentially allowing full remote code execution and control over the affected system. The issue impacts all versions up to and including 1.0.2. There is no indication of an official patch or vendor advisory at this time.

Successful exploitation allows an attacker to upload a web shell, leading to full system compromise with complete loss of confidentiality, integrity, and availability. This can result in unauthorized access, data theft, data manipulation, and service disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, it is recommended to disable or restrict file upload functionality in the Multi Purpose Mail Form plugin or remove the plugin entirely if not needed. Implementing web application firewall (WAF) rules to block suspicious file uploads may provide temporary mitigation.