The vulnerability CVE-2024-56050 in VibeThemes WPLMS plugin (versions before 1.9.9.5.3) permits an attacker with low privileges to upload files with dangerous types, such as web shells, without restriction. This can result in remote code execution and full system compromise. The CVSS 3.1 base score is 9.9, reflecting network attack vector, low attack complexity, no user interaction, and complete impact on confidentiality, integrity, and availability. The vulnerability is publicly disclosed but no patch or official fix details are currently available.

Successful exploitation allows an attacker to upload and execute arbitrary code on the web server, leading to full compromise of the affected system. This impacts confidentiality, integrity, and availability of the system and data hosted by the vulnerable WPLMS plugin. The critical CVSS score of 9.9 reflects the severity of this impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the plugin upload functionality to trusted users only and consider disabling file uploads if feasible. Monitor for suspicious activity related to file uploads. Avoid deploying the vulnerable versions in production environments.