CVE-2024-12110: 
WordPress vulnerability analysis and mitigation

The Gold Addons for Elementor plugin for WordPress contains a vulnerability (CVE-2024-12110) related to unauthorized modification of data. The vulnerability affects all versions up to and including 1.3.2, and was disclosed on December 6, 2024. The issue stems from missing capability checks in the activate() and deactivate() functions (NVD NIST).

The vulnerability is classified as a Missing Authorization issue (CWE-862). It has been assigned a CVSS v3.1 Base Score of 4.3 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. The technical root cause is the absence of proper capability checks in the plugin's activate() and deactivate() functions (NVD NIST).

The vulnerability allows authenticated attackers with Subscriber-level access or higher to activate and deactivate licenses within the plugin. This unauthorized access to license management functions could potentially impact the plugin's functionality and licensing controls (NVD NIST).

The vulnerability requires an authenticated user with at least Subscriber-level privileges to exploit. The attack complexity is considered Low (AC:L) according to the CVSS scoring, indicating that the vulnerability is relatively straightforward to exploit once an attacker has the required access level (NVD NIST).

The vulnerability has been documented in Wordfence's weekly WordPress vulnerability report for December 2-8, 2024, where it was noted as currently unpatched (Wordfence Blog).