CVE-2024-9659 is a critical vulnerability in the dasinfomedia School Management System for WordPress plugin caused by improper validation of uploaded files in the mj_smgt_user_avatar_image_upload() function. This allows unauthenticated attackers to upload arbitrary files, potentially enabling remote code execution on the server hosting the plugin. The vulnerability affects all versions up to and including 91.5.0. The CVSS v3.1 base score is 9.8, reflecting network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or official fix has been documented yet.

Successful exploitation allows unauthenticated attackers to upload arbitrary files to the affected WordPress site, which may lead to remote code execution. This compromises the confidentiality, integrity, and availability of the affected system. Given the critical CVSS score of 9.8, the impact is severe and could result in full system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to disable or restrict the vulnerable file upload functionality if possible, and monitor for suspicious activity related to file uploads. Avoid using the affected plugin versions in production environments where possible.