The vulnerability CVE-2024-56264 affects the Beee ACF City Selector plugin up to version 1.14.0. It allows users with high privileges to upload files without proper restrictions on file types, including dangerous files such as web shells. This can lead to an attacker executing arbitrary code on the server, impacting confidentiality, integrity, and availability. The CVSS 3.1 base score is 6.6, reflecting network attack vector, low attack complexity, required high privileges, no user interaction, and a scope change with low impact on confidentiality, integrity, and availability.

An attacker with high privileges can upload malicious files (e.g., web shells) to the server, potentially enabling unauthorized code execution. This can lead to partial compromise of the affected system's confidentiality, integrity, and availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict user privileges to prevent unauthorized file uploads and monitor for suspicious file upload activity related to the ACF City Selector plugin.