The vulnerability CVE-2024-52384 in the wpmonks Sage AI plugin enables unrestricted upload of files with dangerous types, such as web shells, to the web server. This occurs because the plugin does not properly restrict or validate file uploads, allowing an attacker with low privileges to upload malicious files. The vulnerability affects all versions up to and including 2.4.9. The CVSS 3.1 base score is 9.9, reflecting network attack vector, low attack complexity, no user interaction, privileges required, and complete impact on confidentiality, integrity, and availability. No official patch or vendor advisory is currently available, and the plugin is not a cloud service, so remediation depends on the vendor or user applying updates once available.

Successful exploitation allows an attacker to upload and execute arbitrary code on the web server via web shells, leading to full system compromise. This impacts confidentiality, integrity, and availability of the affected environment. Given the critical CVSS score and the nature of the vulnerability, the risk to affected installations is severe.

Patch status is not yet confirmed—check the vendor advisory for current remediation guidance. Until an official fix is released, restrict file upload permissions, disable or limit the plugin usage, and monitor for suspicious file uploads. Avoid granting unnecessary privileges to users who can upload files. Once a vendor patch or update is available, apply it promptly to remediate this vulnerability.