CVE-2024-30505: 
WordPress vulnerability analysis and mitigation

A Missing Authorization vulnerability was discovered in the WordPress Church Admin plugin, affecting versions up to 4.1.18. The vulnerability was reported by researcher CatFather on February 29, 2024, and was publicly disclosed on March 28, 2024. The issue was assigned CVE-2024-30505 and is classified as a Broken Access Control vulnerability (Patchstack).

The vulnerability is categorized as CWE-862 (Missing Authorization) and has received a CVSS v3.1 score of 5.4 (Medium), with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L. The issue requires Subscriber-level privileges to exploit and represents a broken access control condition where authorization checks are missing (Patchstack).

The vulnerability allows an unprivileged user to execute certain higher privileged actions due to missing authorization, authentication, or nonce token checks. The specific impact varies case by case, but the vulnerability is considered moderately dangerous and is known to be exploited in the wild (Patchstack).

The vulnerability has been confirmed to be actively exploited in the wild. The attack vector is network-accessible (AV:N) with low attack complexity (AC:L) and requires low privileges (PR:L) with no user interaction (UI:N) (Patchstack).

The vulnerability has been fixed in version 4.1.19 of the Church Admin plugin. Users are advised to update to this version or later immediately. For users of Patchstack, a virtual patch has been issued to mitigate this issue by blocking potential attacks until the update can be applied (Patchstack).