What is the CVSS score of CVE-2024-50523?

CVE-2024-50523 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.9%.

Which versions of RainbowLink Inc. All Post Contact Form are affected by CVE-2024-50523?

The RainbowLink All Post Contact Form WordPress plugin (versions 1.8.2 and earlier) contains a critical unrestricted file upload vulnerability enabling remote unauthenticated attackers to upload web…

How to fix or mitigate CVE-2024-50523?

Within 24 hours: Asset inventory-identify all WordPress installations with RainbowLink All Post Contact Form plugin; document versions deployed. Within 7 days: Remove the plugin entirely; if core contact form functionality is business-critical, deploy Web Application Firewall (WAF) rules blocking upload endpoints and permitting only whitelisted file types as temporary control. Within 30 days: Conduct forensic audit of affected systems for indicators of compromise (unauthorized files, web shells, suspicious logs); transition to a patched contact form alternative.

RainbowLink Inc. All Post Contact Form CVE-2024-50523

CRITICAL

Unrestricted Upload of File with Dangerous Type (CWE-434)

2024-11-04 audit@patchstack.com

File Upload

10.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVSS changed

Apr 23, 2026 - 15:22 NVD

9.8 (CRITICAL) 10.0 (CRITICAL)

CVE Published

Nov 04, 2024 - 14:15 nvd

CRITICAL 9.8

DescriptionCVE.org

Unrestricted Upload of File with Dangerous Type vulnerability in RainbowLink Inc. All Post Contact Form allpost-contactform allows Upload a Web Shell to a Web Server.This issue affects All Post Contact Form: from n/a through <= 1.8.2.

AnalysisAI

Unrestricted file upload in the RainbowLink All Post Contact Form WordPress plugin (versions up to and including 1.8.2) allows remote unauthenticated attackers to upload web shells and achieve full server compromise. The CVSS 10.0 score with scope change (S:C) indicates the impact extends beyond the vulnerable component to the underlying WordPress host. No public exploit identified at time of analysis, and EPSS of 0.89% (75th percentile) suggests moderate but not yet widespread exploitation interest.