CVE-2024-9849 is a CWE-434 vulnerability in the Real 3D Flipbook – 3D FlipBook, PDF FlipBook, PDF Viewer, PDF Embedder WordPress plugin. It arises from missing file type validation in the 'r3dfb_save_thumbnail_callback' function, allowing authenticated users with Author-level privileges or higher to upload arbitrary files to the server. This can potentially enable remote code execution. The vulnerability affects all versions up to and including 4.8. The CVSS v3.1 base score is 8.8, indicating high severity with network attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability.

An attacker with Author-level access or higher can upload arbitrary files to the affected WordPress server, potentially leading to remote code execution. This compromises the confidentiality, integrity, and availability of the affected system. The vulnerability is exploitable remotely over the network and requires no user interaction beyond authentication at the Author level or above.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor for updates from creativeinteractivemedia. Until a fix is available, restrict Author-level access to trusted users only and consider disabling or removing the vulnerable plugin to mitigate risk.