CVE-2024-32684: 
WordPress vulnerability analysis and mitigation

A Missing Authorization vulnerability was discovered in Wpmet Wp Ultimate Review plugin affecting versions through 2.2.5. The vulnerability was reported by Kyle Sanchez on January 5, 2024, and was publicly disclosed on April 17, 2024 (Patchstack Advisory).

The vulnerability is classified as a broken access control issue (CWE-862) due to missing authorization checks. It received a CVSS v3.1 base score of 7.5 (HIGH) according to NIST's assessment, while Patchstack assigned it a score of 5.3 (MEDIUM). The vulnerability allows unprivileged users to execute certain higher privileged actions due to missing authorization, authentication, or nonce token checks (Patchstack Advisory).

The vulnerability could allow unauthorized users to perform actions that should be restricted to users with higher privileges. However, Patchstack has classified this as a low-severity impact that is unlikely to be exploited (Patchstack Advisory).

The vulnerability requires no authentication to exploit, as indicated by the CVSS vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N (NVD).

Users are advised to update to version 2.3.0 or later of the WP Ultimate Review plugin to remediate this vulnerability. This version contains the necessary fixes to address the broken access control issue (Patchstack Advisory).