CVE-2024-32517: 
WordPress vulnerability analysis and mitigation

A Missing Authorization vulnerability was discovered in the WooCommerce & WordPress Tutorials Custom Thank You Page Customize For WooCommerce plugin by Binary Carpenter, affecting versions through 1.4.12. The vulnerability was reported on November 18, 2023, and publicly disclosed on April 15, 2024 (Patchstack).

The vulnerability is classified as a Broken Access Control issue (CWE-862) with a CVSS v3.1 score of 4.3 (Medium), based on the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. The issue stems from missing authorization checks that could allow an unprivileged user to execute certain higher privileged actions (Patchstack).

The vulnerability has been assessed as having a low severity impact and is considered unlikely to be exploited. While it allows unauthorized access to certain functions, the impact is limited to integrity-related concerns with no direct effect on confidentiality or availability (Patchstack).

The vulnerability requires a low attack complexity and can be exploited by an authenticated user with subscriber-level privileges (Patchstack).

The vulnerability has been fixed in version 1.4.14 of the plugin. Users are advised to update to this version or later to resolve the security issue. Patchstack has also issued a virtual patch to mitigate this vulnerability by blocking potential attacks until users can update to the fixed version (Patchstack).