CVE-2024-32604: 
WordPress vulnerability analysis and mitigation

An Authorization Bypass Through User-Controlled Key vulnerability was discovered in the WP-Recall WordPress plugin, affecting versions through 16.26.5. The vulnerability was disclosed on April 16, 2024, and has been assigned CVE-2024-32604. WP-Recall is a WordPress plugin that provides registration, profile, and commerce functionality (Patchstack).

The vulnerability is classified as an Insecure Direct Object References (IDOR) issue with a CVSS v3.1 base score of 4.3 (Medium), and vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. The weakness is categorized under CWE-639 (Authorization Bypass Through User-Controlled Key) (Patchstack).

The vulnerability could allow a malicious actor to bypass authorization and authentication mechanisms, potentially leading to unauthorized access to sensitive files, folders, or database interactions (Patchstack).

The vulnerability requires an attacker to have at least Subscriber-level privileges to exploit. It has been assessed as having a low severity impact and is considered unlikely to be exploited (Patchstack).

The vulnerability has been fixed in version 16.26.6 of the WP-Recall plugin. Users are advised to update to this version or later to remove the vulnerability (Patchstack).