CVE-2024-24716: 
WordPress vulnerability analysis and mitigation

The vulnerability (CVE-2024-24716) affects the Awesome Support – WordPress HelpDesk & Support Plugin for WordPress in versions up to and including 6.1.6. The vulnerability was discovered by Brandon James Roldan and was publicly disclosed on March 12, 2024. It involves an insufficient authorization issue that affects the plugin's attachment handling functionality (WPScan, Patchstack).

The vulnerability stems from an insufficient capability check in the wpas_can_delete_attachments() function. It has been assigned a CVSS score of 5.4 (Low severity) and is classified under the OWASP Top 10 category A5: Broken Access Control and CWE-863. The technical assessment indicates this is an incorrect authorization implementation that could allow privilege escalation (WPScan, Patchstack).

The vulnerability allows authenticated attackers with subscriber-level access and above to delete attachments in the WordPress system, potentially leading to unauthorized modification or removal of data (WPScan).

The vulnerability requires an authenticated user with at least subscriber-level access to exploit. While the severity is considered low, it represents a broken access control issue that could be leveraged by malicious users (Patchstack).

The vulnerability has been patched in version 6.1.7 of the Awesome Support plugin. Users are advised to update to this version or later to resolve the security issue. The fix addresses the insufficient authorization check in the attachment deletion functionality (Patchstack).