The vulnerability CVE-2024-56046 in VibeThemes WPLMS (up to version 1.9.9) allows unauthenticated attackers to upload files of dangerous types without restriction. This can be exploited to upload web shells to the server, enabling remote code execution and full compromise of the affected system. The vulnerability is remotely exploitable over the network without requiring any privileges or user interaction. It is rated critical with a CVSS 3.1 base score of 10.0, reflecting its severe impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability allows attackers to upload and execute arbitrary code on the web server hosting WPLMS. This can lead to complete system compromise, data theft, data manipulation, and denial of service. The vulnerability affects all installations running WPLMS version 1.9.9 or earlier.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict file upload permissions, disable file uploads if possible, or implement web application firewall rules to block malicious upload attempts. Monitor vendor channels for updates and apply patches immediately once available.