The vulnerability CVE-2024-52379 affects the kineticPay for WooCommerce plugin by allowing unrestricted upload of files with dangerous types. This enables attackers to upload malicious files such as web shells to the server hosting the plugin, potentially leading to full system compromise. The issue affects all versions up to 2.0.8. The CVSS v3.1 base score is 10.0, reflecting network attack vector, no privileges or user interaction required, and complete impact on confidentiality, integrity, and availability.

Successful exploitation allows an unauthenticated attacker to upload arbitrary files, including web shells, to the web server. This can result in full compromise of the server, including data theft, modification, and service disruption. The vulnerability is critical due to the ease of exploitation and the severity of impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to restrict file upload permissions, disable the plugin if possible, or implement web application firewall rules to block malicious upload attempts. Monitor for any suspicious activity related to file uploads.