CVE-2024-8242 is a CWE-434 vulnerability in the MStore API – Create Native Android & iOS Apps On The Cloud WordPress plugin. The issue arises from insufficient file type validation in the update_user_profile() function, permitting authenticated users with subscriber-level privileges or higher to upload arbitrary files except PHP files. This vulnerability could potentially lead to remote code execution if chained with other vulnerabilities such as unauthenticated registration endpoints. The CVSS 3.1 base score is 4.3, reflecting a medium severity with network attack vector, low attack complexity, and requiring privileges.

Authenticated attackers with subscriber-level access can upload arbitrary files to the server hosting the vulnerable plugin. While direct PHP file upload is blocked, the ability to upload other file types might be leveraged to achieve remote code execution when combined with other vulnerabilities or misconfigurations. This could compromise the affected WordPress site’s integrity and potentially allow further attacks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles and permissions to minimize exposure, and monitor for suspicious file uploads. Avoid granting subscriber-level or higher access to untrusted users. Review and harden file upload handling in the plugin if possible.