CVE-2024-32687: 
WordPress vulnerability analysis and mitigation

A Missing Authorization vulnerability was discovered in WPClever WPC Frequently Bought Together for WooCommerce plugin affecting versions up to 7.0.3. The vulnerability was reported on April 17, 2024, and was assigned CVE-2024-32687. This security issue involves broken access control that could allow unprivileged users to execute certain higher privileged actions (Patchstack).

The vulnerability is classified as a Missing Authorization issue (CWE-862) with a CVSS v3.1 base score of 4.3 (Medium), using the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. The issue requires Subscriber level privileges to exploit (Patchstack).

The vulnerability has been assessed as having a low severity impact and is considered unlikely to be exploited. It primarily affects the access control mechanisms of the plugin, potentially allowing unauthorized access to certain functionalities (Patchstack).

The vulnerability requires Subscriber level privileges to exploit, indicating that an attacker would need at least basic authentication to the WordPress site. The low CVSS score suggests that while the vulnerability exists, its exploitation potential is limited (Patchstack).

The vulnerability has been fixed in version 7.0.4 of the WPC Frequently Bought Together for WooCommerce plugin. Users are advised to update to this version or later to remove the vulnerability. Additionally, Patchstack has issued a virtual patch to mitigate this issue by blocking potential attacks until users can update to the fixed version (Patchstack).