The vulnerability identified as CVE-2024-52404 affects the CF7 Reply Manager plugin by bigfiveagency, specifically versions up to and including 1.2.3. It allows an attacker with low privileges to upload files of dangerous types without restriction or user interaction. The CVSS v3.1 base score is 9.9 (critical), reflecting network attack vector, low attack complexity, no user interaction, and complete impact on confidentiality, integrity, and availability. No patch or remediation information is currently provided, and no known exploits are reported in the wild.

Successful exploitation could allow an attacker to upload and execute malicious files on the affected system, leading to full compromise of the confidentiality, integrity, and availability of the system running the vulnerable plugin. This could result in data theft, data modification, or denial of service conditions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the plugin and file upload functionality to trusted users only, and monitor for suspicious activity related to file uploads. Avoid exposing the affected plugin on publicly accessible systems if possible.