The vulnerability CVE-2024-54370 affects SuitePlugins Video & Photo Gallery for Ultimate Member versions up to 1.1.0. It permits an attacker with low privileges to upload files of dangerous types without restriction, including web shells, to the web server. This can lead to full system compromise by allowing remote code execution and unauthorized control over the affected web application. The CVSS 3.1 base score is 9.9, reflecting network attack vector, low attack complexity, no user interaction, and complete impact on confidentiality, integrity, and availability. The vulnerability is published but no patch or official fix has been disclosed yet.

Successful exploitation allows an attacker to upload and execute arbitrary code on the web server hosting the plugin, resulting in full compromise of the affected system's confidentiality, integrity, and availability. This can lead to unauthorized access, data theft, defacement, or disruption of services.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict file upload permissions, disable or limit the plugin functionality if possible, and monitor for suspicious file uploads. Avoid granting unnecessary privileges to users who can upload files.