CVE-2024-31421: 
WordPress vulnerability analysis and mitigation

A Missing Authorization vulnerability was identified in the Popup by Supsystic WordPress plugin affecting versions through 1.10.27. The vulnerability was discovered by Steven Julian and was assigned CVE-2024-31421. The issue was reported on January 8, 2024, and publicly disclosed on April 10, 2024 (Patchstack).

The vulnerability is classified as a Broken Access Control issue (CWE-862) with a CVSS v3.1 base score of 4.3 (Medium), and vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. The issue stems from missing authorization checks that could allow unprivileged users to execute certain higher privileged actions (Patchstack).

The vulnerability has been assessed as having a low severity impact. It affects the security of WordPress installations running the vulnerable versions of the Popup by Supsystic plugin, potentially allowing subscriber-level users to perform unauthorized actions (Patchstack).

The vulnerability requires a low attack complexity but also requires low privileges (authenticated access) to exploit. According to the assessment, it is unlikely to be exploited in practice (Patchstack).

The vulnerability has been fixed in version 1.10.28 of the Popup by Supsystic plugin. Users are advised to update to this version or later to remediate the security issue (Patchstack).