CVE-2024-8480 is a missing authorization vulnerability (CWE-862) in the Sirv Image Optimizer, Resizer and CDN plugin for WordPress. The flaw exists because the 'sirv_save_prevented_sizes' function does not perform proper capability checks, allowing users with Contributor-level privileges or higher to invoke the 'sirv_upload_file_by_chunks_callback' function. This callback lacks adequate file type validation, enabling arbitrary file uploads to the affected server. Such uploads may facilitate remote code execution. The vulnerability affects all versions up to and including 7.2.7. The CVSS 3.1 base score is 8.8, reflecting network attack vector, low attack complexity, required privileges at the contributor level, no user interaction, and high impact on confidentiality, integrity, and availability.

An attacker with Contributor-level or higher access on a WordPress site using the vulnerable Sirv plugin can upload arbitrary files due to missing authorization and insufficient file validation. This can lead to remote code execution on the server, compromising confidentiality, integrity, and availability of the affected system. The vulnerability is rated high severity with a CVSS score of 8.8. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — no official fix or patch links have been provided by the vendor. Users should monitor the vendor's advisory channels for updates. Until a patch is available, restrict Contributor-level access to trusted users only and consider disabling or removing the Sirv plugin if possible to reduce exposure.