CVE-2024-32081: 
WordPress vulnerability analysis and mitigation

CVE-2024-32081 is a Missing Authorization vulnerability affecting the WordPress plugin Filter Custom Fields & Taxonomies Light through version 1.05. The vulnerability was discovered and reported by researcher Mika, with the initial disclosure made on April 11, 2024 (Patchstack).

The vulnerability has been assigned a CVSS v3.1 base score of 8.8 (HIGH) by NVD with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, while Patchstack assigned a CVSS score of 4.3 (MEDIUM). The vulnerability is classified as CWE-862 (Missing Authorization) and represents a broken access control issue that could allow unprivileged users to execute higher privileged actions (Patchstack).

The vulnerability could potentially allow unauthorized users to perform actions that should be restricted to users with higher privileges. However, Patchstack has classified this as a low-priority issue that is unlikely to be exploited (Patchstack).

The vulnerability requires a low attack complexity and can be exploited by an attacker with low privileges. The minimum required privilege level for exploitation is that of a Subscriber role (Patchstack).

As of the current date, no official fix has been released for this vulnerability. The issue affects all versions through 1.05 of the Filter Custom Fields & Taxonomies Light plugin (Patchstack).