The vulnerability CVE-2024-56249 affects the WPMasterToolKit plugin by Ludwig You, allowing users with high privileges to upload files without proper restrictions on file types. This unrestricted upload capability can be exploited to upload a web shell, potentially enabling remote code execution and full system compromise. The issue affects all versions up to and including 1.13.1. The CVSS 3.1 base score is 9.1, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, scope change, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker with high privileges to upload malicious files such as web shells, leading to full compromise of the web server. This includes unauthorized access, data theft, data modification, and disruption of service. The vulnerability impacts confidentiality, integrity, and availability severely.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the plugin to trusted administrators only and monitor for suspicious file uploads. Avoid exposing the affected plugin to untrusted users. Follow vendor updates closely for an official patch or mitigation instructions.