CVE-2024-9660 is a vulnerability in the dasinfomedia School Management System for WordPress plugin that arises from improper validation of uploaded file types in the mj_smgt_load_documets_new() and mj_smgt_load_documets() functions. Authenticated users with at least Student-level privileges can upload arbitrary files, potentially enabling remote code execution on the server hosting the WordPress site. This affects all plugin versions up to and including 91.5.0. The vulnerability has a CVSS 3.1 base score of 8.8, indicating high severity. No patch or official fix has been documented yet, and no public exploits are known.

An attacker with authenticated access at the Student level or above can upload arbitrary files to the server due to lack of file type validation. This can lead to remote code execution, compromising confidentiality, integrity, and availability of the affected system. The high CVSS score reflects the critical nature of this impact. No known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user permissions to prevent unauthorized file uploads and monitor for suspicious activity related to file uploads. Consider disabling or limiting the use of the affected plugin if possible.