CVE-2024-2505: 
WordPress vulnerability analysis and mitigation

The GamiPress WordPress plugin before version 6.8.9 contains a broken access control vulnerability (CVE-2024-2505) discovered in April 2024. The vulnerability affects the plugin's access control mechanism, which fails to properly restrict access to its settings (WPScan).

The vulnerability allows Authors to manipulate requests and extend access to lower privileged users, such as Subscribers, despite initial settings prohibiting such access. This represents a broken access control issue that enables unauthorized users to modify critical plugin configurations. The vulnerability has been assigned a CVSS v3.1 score of 8.1 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N (NVD).

The vulnerability enables unauthorized users to modify critical GamiPress plugin configurations, potentially compromising the security and functionality of affected WordPress installations. The high CVSS score indicates significant potential impact on confidentiality and integrity of the affected systems (NVD).

The vulnerability can be exploited by users with Author-level privileges to manipulate requests and extend access to lower privileged users like Subscribers. The attack requires low complexity and no user interaction, making it relatively straightforward to exploit (WPScan).

The vulnerability has been patched in GamiPress version 6.8.9. Users are strongly advised to update to this version or later to mitigate the risk (WPScan).