CVE-2024-30466: 
WordPress vulnerability analysis and mitigation

The WooCommerce Multilingual & Multicurrency plugin for WordPress contains a Missing Authorization vulnerability (CVE-2024-30466) that affects versions up to and including 5.3.4. The vulnerability was discovered by Rafie Muhammad and publicly disclosed on March 28, 2024. This security issue impacts the plugin's access control mechanisms, potentially allowing authenticated users with subscriber-level access and above to perform unauthorized actions (Patchstack, WPScan).

The vulnerability is classified as CWE-862 (Missing Authorization) and has received varying CVSS scores from different sources. The National Vulnerability Database (NVD) assigned a CVSS v3.1 Base Score of 8.8 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, while Patchstack rated it at 5.4 (MEDIUM) with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L. The vulnerability falls under the OWASP Top 10 category A5: Broken Access Control (NVD, Patchstack).

The vulnerability allows authenticated attackers with subscriber-level access or higher to perform unauthorized actions within the WooCommerce Multilingual & Multicurrency plugin. This broken access control issue could potentially lead to privilege escalation and unauthorized manipulation of plugin functionality (WPScan).

The vulnerability requires an authenticated user with at least subscriber-level access to exploit. While specific exploit details are not publicly available, the low complexity (AC:L) and low privilege requirement (PR:L) in the CVSS scores indicate that exploitation is relatively straightforward for authenticated users (NVD).

The vulnerability has been fixed in version 5.3.5 of the WooCommerce Multilingual & Multicurrency plugin. Users are strongly advised to update to this version or later to address the security issue. Additionally, Patchstack has issued a virtual patch to mitigate this issue by blocking potential attacks until users can update to the fixed version (Patchstack).