CVE-2024-21748: 
WordPress vulnerability analysis and mitigation

A Missing Authorization vulnerability was discovered in the Icegram WordPress plugin affecting versions up to 3.1.21. The vulnerability allows contributors and users with higher privileges to perform unauthorized actions such as duplicating and toggling campaign status (Patchstack, WPScan).

The vulnerability is classified as CWE-862 (Missing Authorization) with a CVSS v3.1 base score of 5.4 (Medium) according to NVD, and 4.3 (Medium) according to Patchstack. The vulnerability vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L, indicating it requires network access and low privileges to exploit, with potential impact on integrity and availability (NVD).

The vulnerability could allow contributors and users with higher privileges to perform unauthorized actions on campaigns, including toggling campaign status and duplicating campaigns, potentially affecting the integrity and availability of campaign management (WPScan).

The vulnerability requires an authenticated user with at least contributor-level access to exploit. No known exploits in the wild have been reported (Patchstack).

The vulnerability has been fixed in version 3.1.22 of the Icegram plugin. Users are advised to update to this version or later to resolve the security issue (Patchstack).