CVE-2024-30507: 
WordPress vulnerability analysis and mitigation

An Authorization Bypass Through User-Controlled Key vulnerability (CVE-2024-30507) was discovered in the Molongui Authorship WordPress plugin affecting versions up to 4.7.7. The vulnerability was reported on January 30, 2024, and publicly disclosed on March 28, 2024. This security issue is classified as an Insecure Direct Object References (IDOR) vulnerability, which falls under the OWASP Top 10 category of Broken Access Control (Patchstack).

The vulnerability has been assigned a CVSS v3.1 Base Score of 2.7 (Low) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N. The issue is identified as CWE-639 (Authorization Bypass Through User-Controlled Key) and requires Author-level privileges to exploit (Patchstack).

The vulnerability could potentially allow a malicious actor with Author-level access to bypass authorization, authentication, access sensitive files/folders, or interact with the database. However, due to its low severity rating, the actual impact is considered minimal and unlikely to be exploited (Patchstack).

The vulnerability requires Author-level privileges to exploit, which significantly limits its potential impact. The CVSS metrics indicate that while the attack complexity is low, it requires high privileges to execute (Patchstack).

The vulnerability has been fixed in version 4.7.8 of the Molongui Authorship plugin. Users are advised to update to version 4.7.8 or later to remove the vulnerability. The security issue has a low severity impact, and the update serves as the primary mitigation strategy (Patchstack).