CVE-2024-32678: 
WordPress vulnerability analysis and mitigation

A Missing Authorization vulnerability was discovered in TrackShip for WooCommerce affecting versions through 1.7.5. The vulnerability was disclosed on April 17, 2024, and was assigned CVE-2024-32678. This security issue is classified as a broken access control vulnerability with a CVSS v3.1 base score of 5.3 (Medium) (Patchstack).

The vulnerability is categorized as CWE-862 (Missing Authorization) and has been assigned a CVSS v3.1 vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. This indicates that the vulnerability can be exploited over the network, requires low attack complexity, needs no privileges, and requires no user interaction. The scope is unchanged, with potential impact limited to integrity (Patchstack).

The vulnerability could allow an unprivileged user to execute certain higher privileged actions due to missing authorization, authentication, or nonce token checks (Patchstack).

The vulnerability is classified as having low attack complexity and requires no special privileges or user interaction to exploit. It can be accessed remotely over the network (Patchstack).

The vulnerability has been fixed in version 1.7.6 of TrackShip for WooCommerce. Users are advised to update to this version or later to remove the vulnerability. Patchstack has issued a virtual patch to mitigate this issue by blocking potential attacks until users can update to the fixed version (Patchstack).