The vulnerability CVE-2024-52408 affects the Push Notifications for WordPress by PushAssist plugin, allowing an attacker with low privileges to upload files of dangerous types without restriction. This can be exploited to upload a web shell, granting remote code execution capabilities on the web server. The issue affects all versions up to and including 3.0.8. The CVSS 3.1 base score is 9.9, reflecting network attack vector, low attack complexity, no user interaction, and complete impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available to confirm remediation status.

Successful exploitation allows an attacker with low privileges to upload a web shell, which can lead to full system compromise including unauthorized access, data theft, modification, and service disruption. The vulnerability impacts confidentiality, integrity, and availability of the affected WordPress installation and potentially the underlying server environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the plugin's upload functionality to trusted users only and consider disabling or removing the plugin if possible. Monitor for suspicious file uploads and web shell activity as a temporary mitigation.