CVE-2024-1109: 
WordPress vulnerability analysis and mitigation

The Podlove Podcast Publisher WordPress plugin (versions up to 4.0.11) contains a vulnerability identified as CVE-2024-1109, discovered and disclosed on February 6, 2024. The vulnerability stems from missing capability checks on the init_download() and init() functions, which could allow unauthorized access to sensitive data (NVD).

The vulnerability is characterized by a missing authorization check that affects the init_download() and init() functions. It has been assigned a CVSS v3.1 base score of 5.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. The vulnerability is classified under CWE-862 (Missing Authorization) (NVD, Wordfence).

The vulnerability allows unauthenticated attackers to export the plugin's tracking data and podcast information, potentially exposing sensitive data without proper authorization (NVD).

The vulnerability can be exploited by unauthenticated attackers who can access certain plugin functions without proper authorization checks. No user interaction is required for exploitation (NVD).

The vulnerability has been patched in a security update. Users should update to a version newer than 4.0.11. The fix includes adding proper capability checks and nonce validation to the exporter functions (Github Patch).