CVE-2024-32518: 
WordPress vulnerability analysis and mitigation

A Missing Authorization vulnerability was discovered in PeproDev Ultimate Invoice WordPress plugin affecting versions up to 2.0.0. The vulnerability was initially reported on November 14, 2023, by security researcher Abdi Pranata and was officially published on April 15, 2024, with the identifier CVE-2024-32518 (Patchstack Database).

The vulnerability is classified as a Broken Access Control issue (CWE-862) with a CVSS v3.1 base score of 5.3 (Medium). The vulnerability vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, indicating that it can be exploited over the network with low attack complexity, requires no privileges or user interaction, and has a limited impact on integrity (NVD Database).

The vulnerability allows an unprivileged user to execute certain higher privileged actions due to missing authorization, authentication, or nonce token checks. While the specific impact varies case by case, the CVSS score indicates that the vulnerability primarily affects the integrity of the system with no direct impact on confidentiality or availability (Patchstack Database).

The vulnerability is considered moderately dangerous and is expected to become exploited. It requires no authentication to exploit, making it accessible to unauthenticated attackers (Patchstack Database).

Users are advised to update to version 2.0.2 or later to resolve the vulnerability. For users of Patchstack, a virtual patch has been issued to mitigate this issue by blocking potential attacks until the update to a fixed version can be completed (Patchstack Database).