CVE-2024-2538: 
WordPress vulnerability analysis and mitigation

The Permalink Manager Lite WordPress plugin contains a vulnerability (CVE-2024-2538) affecting all versions up to and including 2.4.3.1. The vulnerability stems from a missing capability check on the 'ajax_save_permalink' function, which allows authenticated attackers with author-level access or higher to modify permalinks of arbitrary posts (NVD).

The vulnerability exists due to improper authorization controls in the plugin's permalink modification functionality. The 'ajax_save_permalink' function lacks proper capability verification, enabling users with author privileges to manipulate permalinks beyond their authorized scope. The issue has been assigned a CVSS v3.1 base score of 4.3 (Medium) by NVD and 5.4 (Medium) by Wordfence, with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N (NVD).

The vulnerability allows authenticated attackers with author-level access to modify permalinks of any post on the website, including privately published posts by administrators. This can lead to unauthorized content manipulation and potential URL hijacking. An attacker can create their own post and replace all permalinks of other users' posts and pages to display their content instead (GitHub Exploit).

A proof-of-concept exploit has been publicly released demonstrating how an authenticated attacker with author privileges can modify permalinks of arbitrary posts. The exploit involves using the WordPress REST API to manipulate permalinks without proper authorization checks (GitHub Exploit).

Website administrators should immediately update to version 2.4.3.2 or later of the Permalink Manager Lite plugin, which includes a fix for this vulnerability. The fix implements proper authorization checks to verify if low-privileged users like Authors or Contributors are only modifying permalinks for their own posts (WordPress Plugin).