The vulnerability CVE-2024-50526 affects the Multi Purpose Mail Form plugin by Lindeni Mahlalela, allowing attackers to upload files of dangerous types without restriction. This can be exploited to upload a web shell, granting remote code execution capabilities on the affected server. The issue impacts all versions up to and including 1.0.2. The CVSS 3.1 base score is 10.0, reflecting a critical risk with network attack vector, no required privileges or user interaction, and complete compromise of confidentiality, integrity, and availability. No patch or official fix has been documented or linked by the vendor as of the published date.

Successful exploitation allows an unauthenticated attacker to upload arbitrary files, including web shells, to the target server. This can lead to full remote code execution, complete system compromise, data theft, service disruption, and potentially further network pivoting. The vulnerability is critical due to the ease of exploitation and the high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to restrict or disable file upload functionality in the affected plugin, implement web application firewall (WAF) rules to block suspicious file uploads, and monitor for any unauthorized file changes on the server. Avoid exposing the vulnerable plugin to untrusted users or the public internet if possible.