CVE-2024-2222: 
WordPress vulnerability analysis and mitigation

The Advanced Classifieds & Directory Pro plugin for WordPress (versions up to and including 3.0.0) contains a vulnerability identified as CVE-2024-2222. The vulnerability was discovered on March 19, 2024 and publicly disclosed on April 9, 2024. This security issue stems from a missing capability check on the ajax_callback_delete_attachment function, which affects the plugin's media handling functionality (NVD).

The vulnerability is characterized by a missing capability check in the ajax_callback_delete_attachment function, which allows authenticated users with subscriber-level access or higher to delete arbitrary media uploads. The issue has been assigned a CVSS v3.1 score of 4.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, indicating network accessibility, low attack complexity, and required low privileges (Wordfence).

The vulnerability enables authenticated attackers with subscriber-level access or higher to delete arbitrary media uploads from the WordPress installation. This unauthorized deletion capability could lead to loss of data and potential disruption of website content (NVD).

The vulnerability requires authentication with at least subscriber-level access to exploit. The attack vector is network-accessible and requires low complexity to execute, making it relatively straightforward to exploit for authenticated users (Wordfence).

Website administrators running affected versions of the Advanced Classifieds & Directory Pro plugin should update to a version newer than 3.0.0 to address this vulnerability (NVD).