CVE-2024-32144: 
WordPress vulnerability analysis and mitigation

A Missing Authorization vulnerability was identified in Welcart Inc.'s Welcart e-Commerce WordPress plugin, affecting versions through 2.9.14. The vulnerability was discovered and reported by researcher emad on November 1, 2023, and was officially published on April 12, 2024 (Patchstack).

The vulnerability is classified as a Missing Authorization (CWE-862) issue, which represents a broken access control vulnerability. The CVSS v3.1 scores vary between sources, with NVD assigning a base score of 4.3 (MEDIUM) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, while Patchstack rates it at 5.4 (MEDIUM) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L (NVD).

The vulnerability could allow an unprivileged user to execute certain higher privileged actions due to missing authorization, authentication, or nonce token checks. The specific impact varies case by case, though it has been assessed as having a low severity impact and is considered unlikely to be exploited (Patchstack).

The vulnerability requires low attack complexity and can be exploited remotely with low privileges. No user interaction is required for exploitation, though the overall risk is considered low (NVD).

The vulnerability has been fixed in version 2.10.0 of the Welcart e-Commerce plugin. Users are advised to update to version 2.10.0 or later to remove the vulnerability. Patchstack users can enable auto-update for vulnerable plugins (Patchstack).