CVE-2024-6161 is a vulnerability in the Default Thumbnail Plus WordPress plugin by pjgalbraith, affecting all versions up to 1.0.2.3. The issue arises from a lack of file type validation in the 'get_cache_image' function, enabling authenticated users with contributor or higher privileges to upload arbitrary files. This unrestricted file upload can potentially allow remote code execution on the server hosting the plugin. The vulnerability has a CVSS 3.1 base score of 8.8, indicating high impact on confidentiality, integrity, and availability. No patch or remediation details are currently available, and no known exploits in the wild have been reported.

Authenticated users with contributor-level or higher permissions can upload arbitrary files to the server due to missing file type validation. This can lead to remote code execution, compromising the confidentiality, integrity, and availability of the affected system. The high CVSS score (8.8) reflects the critical nature of this vulnerability in a web application context.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access where possible and monitor for suspicious file uploads related to the Default Thumbnail Plus plugin. Consider disabling or removing the plugin if not essential.