The vulnerability CVE-2024-52402 in gunghoinc's Exclusive Content Password Protect plugin is a CSRF issue that permits unauthorized upload of a web shell to the web server. This affects all versions up to 1.1.0. The vulnerability enables remote attackers to bypass protections by tricking authenticated users into performing unintended actions, resulting in full system compromise. The CVSS 3.1 base score is 9.6, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope change, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker to upload a web shell, which can lead to complete compromise of the affected web server, including unauthorized access, data theft, and potential disruption of services. The critical CVSS score reflects the severe impact on confidentiality, integrity, and availability of the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the plugin's functionality to trusted users only and consider disabling the plugin if feasible. Monitor for suspicious activity related to file uploads. Avoid clicking on untrusted links that could trigger CSRF attacks.