CVE-2021-24742: 
WordPress vulnerability analysis and mitigation

The vulnerability CVE-2021-24742 affects the WordPress Logo Slider and Showcase plugin versions below 1.3.37. The issue was discovered and publicly disclosed on October 4, 2021. This security flaw allows Editor-level users to modify the plugin's settings due to improper authorization controls (WPScan).

The vulnerability stems from an incorrect authorization implementation where the plugin uses a nonce for authorization instead of proper capability checks in the rtWLSSettings AJAX action. This is classified as CWE-863 (Incorrect Authorization) and has been assigned a CVSS score of 2.7 (Low). The vulnerability falls under the OWASP Top 10 category A5: Broken Access Control (WPScan).

When exploited, this vulnerability allows Editor-level users to modify the plugin's settings, potentially affecting the website's logo showcase functionality and its configuration. This represents an elevation of privilege as Editors can perform actions typically restricted to administrators (WPScan).

The vulnerability has been fixed in version 1.3.37 of the Logo Slider and Showcase plugin. Website administrators should update to this version or later to mitigate the security risk (WPScan).