CVE-2024-3071: 
WordPress vulnerability analysis and mitigation

The ACF On-The-Go plugin for WordPress (versions up to 1.0.1) contains a vulnerability identified as CVE-2024-3071, discovered and disclosed on May 2, 2024. The vulnerability stems from a missing capability check on the acfg_update_fields() function, affecting WordPress installations with the plugin installed (NVD).

The vulnerability is characterized by a missing authorization check in the acfg_update_fields() function, which allows authenticated users with subscriber-level privileges or higher to perform unauthorized data modifications. The severity of this vulnerability has been rated as MEDIUM with a CVSS v3.1 base score of 4.3 (Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) (Wordfence).

The vulnerability enables authenticated attackers with subscriber-level access or higher to update arbitrary post titles, descriptions, and ACF values without proper authorization. This could lead to unauthorized modification of content across the WordPress installation (NVD).

The vulnerability requires authentication with at least subscriber-level access, making it exploitable by any authenticated user on the affected WordPress installation. The attack complexity is considered low, requiring no special conditions or user interaction for exploitation (Wordfence).

Users should update their ACF On-The-Go plugin to a version newer than 1.0.1 if available. Until an update is applied, site administrators should carefully review user roles and permissions, potentially restricting subscriber-level access to minimize the risk (NVD).