CVE-2021-24906: 
WordPress vulnerability analysis and mitigation

The Protect WP Admin WordPress plugin before version 3.6.2 contains a security vulnerability identified as CVE-2021-24906. The vulnerability was discovered in December 2021 and affects the plugin's deactivation functionality. This security issue exists in the lib/pwa-deactivate.php file, which lacks proper authorization checks (WPScan).

The vulnerability stems from missing authorization checks in the lib/pwa-deactivate.php file. The issue has been assigned a CVSS v3.1 base score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The vulnerability is classified under CWE-862 (Missing Authorization) (NVD).

If exploited, this vulnerability allows unauthenticated users to disable the Protect WP Admin plugin through a crafted request. This effectively removes the protection mechanisms offered by the plugin, potentially exposing the WordPress admin interface to unauthorized access (WPScan).

The vulnerability has been patched in version 3.6.2 of the Protect WP Admin plugin. Website administrators should update to this version or later to mitigate the security risk (WPScan).