What is the CVSS score of CVE-2024-50531?

CVE-2024-50531 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.9%.

Which versions of RSVPMaker for Toastmasters are affected by CVE-2024-50531?

RSVPMaker for Toastmasters WordPress plugin (versions through 6.2.4) contains a critical unauthenticated file upload vulnerability (CVSS 10.0) that allows attackers to upload web shells and achieve…

How to fix or mitigate CVE-2024-50531?

Within 24 hours: Audit all WordPress installations for RSVPMaker plugin versions ≤6.2.4; immediately disable or remove the plugin from production. Within 7 days: Forensically analyze affected systems for unauthorized file uploads, web shells, and backdoors; review access logs for exploitation attempts during the exposure window. Within 30 days: Monitor RSVPMaker official repository and Toastmasters security channels for patched version release; deploy patch immediately upon availability and implement automated security scanning for upload directories.

RSVPMaker for Toastmasters CVE-2024-50531

CRITICAL

Unrestricted Upload of File with Dangerous Type (CWE-434)

2024-11-04 audit@patchstack.com

File Upload

10.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVSS changed

Apr 23, 2026 - 15:22 NVD

9.8 (CRITICAL) 10.0 (CRITICAL)

CVE Published

Nov 04, 2024 - 14:15 nvd

CRITICAL 9.8

DescriptionCVE.org

Unrestricted Upload of File with Dangerous Type vulnerability in davidfcarr RSVPMaker for Toastmasters rsvpmaker-for-toastmasters allows Upload a Web Shell to a Web Server.This issue affects RSVPMaker for Toastmasters: from n/a through <= 6.2.4.

AnalysisAI

Unrestricted file upload in the RSVPMaker for Toastmasters WordPress plugin (versions through 6.2.4) allows remote unauthenticated attackers to upload web shells and achieve full server compromise. The CVSS 10.0 score reflects scope change with complete confidentiality, integrity, and availability impact, though no public exploit identified at time of analysis and EPSS remains modest at 0.89% (75th percentile).

Technical ContextAI

The vulnerability resides in the RSVPMaker for Toastmasters plugin by davidfcarr (Carr Communications), a WordPress add-on that extends the core RSVPMaker plugin for Toastmasters club event management. CWE-434 (Unrestricted Upload of File with Dangerous Type) indicates the plugin's file upload handler fails to validate file extensions, MIME types, or content against an allowlist, permitting executable PHP files to be written into a web-accessible directory. The CPE string cpe:2.3:a:carrcommunications:rsvpmaker:*:*:*:*:*:wordpress:*:* confirms this is a WordPress plugin running in the PHP execution context of the host site.

RemediationAI

No vendor-released patch identified at time of analysis - the advisory specifies the affected range as 'n/a through <= 6.2.4' without naming a fixed version, so administrators should monitor the WordPress plugin repository and the Patchstack advisory (audit@patchstack.com) for a 6.2.5 or later release and upgrade immediately when available. As immediate compensating controls, deactivate and remove the RSVPMaker for Toastmasters plugin until a patched version ships (trade-off: Toastmasters event RSVP functionality will be unavailable), or place a WAF rule blocking POST requests to the plugin's upload endpoints with executable file extensions such as .php, .phtml, .phar, .php5, and .htaccess. As deeper hardening, restrict the WordPress uploads directory from executing PHP via web server configuration (e.g., an Apache .htaccess php_flag engine off or an nginx location block denying .php execution under wp-content/uploads), which limits impact even if the upload primitive is reached.