The vulnerability identified as CVE-2025-24650 affects the Themefic Tourfic plugin and permits an attacker with high privileges to upload files without proper restrictions on file types. This unrestricted upload capability can be exploited to place a web shell on the server, granting the attacker remote code execution capabilities. The CVSS v3.1 base score is 9.1, reflecting its critical nature with network attack vector, low attack complexity, no user interaction, and complete impact on confidentiality, integrity, and availability. The issue affects all versions up to 2.15.3. No patch or official remediation information is currently provided.

Successful exploitation allows an attacker with high privileges to upload malicious files (e.g., web shells) to the web server, which can lead to full system compromise including unauthorized data access, modification, and service disruption. The vulnerability's critical CVSS score (9.1) indicates severe impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict file upload permissions to trusted users only and consider disabling file uploads if not essential. Monitor for suspicious file uploads and remove any unauthorized files promptly.