CVE-2024-6314 is a critical unrestricted file upload vulnerability in the IQ Testimonials WordPress plugin (versions up to 2.2.7). The flaw exists in the 'process_image_upload' function where file type validation is insufficient, allowing unauthenticated attackers to upload arbitrary files. This can enable remote code execution if the PHP 'gd' extension is not loaded on the server. The vulnerability is categorized under CWE-434 (Unrestricted Upload of File with Dangerous Type). No patch or official remediation guidance is currently available from the vendor.

An attacker can upload arbitrary files without authentication, potentially leading to remote code execution on the affected server if the PHP 'gd' extension is disabled. This compromises the confidentiality, integrity, and availability of the system hosting the vulnerable plugin. The CVSS 3.1 base score of 9.8 reflects the high impact and ease of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should ensure the PHP 'gd' extension is enabled on their servers as this prevents exploitation. Additionally, restricting file upload permissions and monitoring for suspicious uploads may reduce risk.