The vulnerability CVE-2024-56054 in VibeThemes WPLMS (versions before 1.9.9.5.2) permits unrestricted upload of files with dangerous types through the wplms_plugin component. This enables an attacker with high privileges to upload a web shell to the web server, potentially leading to full system compromise. The CVSS 3.1 base score is 9.1, indicating critical severity with network attack vector, low attack complexity, no user interaction, and scope change. The impact includes complete loss of confidentiality, integrity, and availability.

Successful exploitation allows an attacker with high privileges to upload malicious files such as web shells, resulting in full compromise of the web server. This includes unauthorized access, data manipulation, and disruption of service. The vulnerability affects all versions of WPLMS prior to 1.9.9.5.2. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict file upload permissions to trusted users only and monitor for suspicious file uploads. Apply any vendor-provided updates as soon as they are released.