CVE-2024-2036: 
WordPress vulnerability analysis and mitigation

The ApplyOnline – Application Form Builder and Manager plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the aol_modal_box AJAX action in versions up to and including 2.6. This vulnerability, identified as CVE-2024-2036, was discovered and disclosed in May 2024 (NVD).

The vulnerability stems from a missing capability check on the aol_modal_box AJAX action in the plugin. This security flaw allows authenticated users with subscriber-level access or higher to view Application submissions without proper authorization. The vulnerability has been assigned a CVSS v3.1 base score of 4.3 (Medium) (Wordfence).

The vulnerability allows authenticated attackers with subscriber-level access or higher to gain unauthorized access to Application submissions. This could lead to exposure of sensitive information submitted through the application forms (NVD).

The vulnerability requires an authenticated user with at least subscriber-level access to exploit. The attack complexity is considered low as it involves accessing data through an AJAX action without proper authorization checks (Wordfence).

The vulnerability has been patched in version 2.6.3 of the plugin. Site administrators are strongly advised to update to the latest version of the ApplyOnline plugin to address this security issue (WordPress Plugin).