CVE-2021-24207: 
WordPress vulnerability analysis and mitigation

CVE-2021-24207 affects WP Page Builder plugin versions below 1.2.4. The vulnerability was discovered by Ramuel Gall and publicly disclosed on March 17, 2021. This security issue involves an insecure default configuration that allows subscriber-level users to edit and make changes to any and all posts and pages (WPScan).

The vulnerability is classified as an Access Control issue (CWE-284) with a CVSS score of 5.4 (Medium). The security flaw stems from the plugin's default configuration where user roles must be specifically blocked from editing posts and pages, rather than following the principle of least privilege (Wordfence).

Upon registering an account with a site using the WP Pagebuilder plugin, a subscriber-level user could immediately modify or delete existing content on the site. This poses a significant risk to content integrity and site security (WPScan).

The vulnerability was patched in WP Page Builder version 1.2.4. The update changed the User Role Selection box with proper include options and implemented proper user permission settings where only privileged users are selected by default (Themeum).