The vulnerability CVE-2024-51791 affects Made I.T. Forms plugin versions up to 2.8.0, allowing an attacker to upload files without proper restrictions on file types. This unrestricted file upload can be exploited to place a web shell on the server, granting the attacker remote code execution capabilities. The CVSS 3.1 score of 10.0 reflects the critical nature of this flaw, with network access required, no privileges or user interaction needed, and full impact on confidentiality, integrity, and availability. The vulnerability is publicly disclosed but no patch or fix has been linked or confirmed by the vendor. The product is not a cloud service, so remediation depends on vendor updates or user-applied fixes.

Successful exploitation allows an attacker to upload a web shell, leading to remote code execution on the affected server. This can result in complete compromise of the web server, including data theft, data manipulation, and service disruption. The vulnerability is critical with maximum CVSS score, indicating severe impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting file upload functionality in the Made I.T. Forms plugin or implementing additional file type validation and filtering at the web server or application level to prevent dangerous file uploads. Monitor vendor channels for updates and apply patches promptly once released.