CVE-2024-32688: 
WordPress vulnerability analysis and mitigation

A Missing Authorization vulnerability has been identified in Long Watch Studio MyRewards plugin for WordPress, affecting versions up to 5.3.0. The vulnerability was discovered by Emili Castells and was assigned CVE-2024-32688 on April 17, 2024. This security issue has been classified as a broken access control vulnerability (Patchstack).

The vulnerability has been assigned a CVSS v3.1 base score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. The issue is categorized under CWE-862 (Missing Authorization) and requires subscriber-level privileges to exploit (Patchstack).

The vulnerability allows an authenticated user with subscriber-level access to execute certain higher privileged actions due to missing authorization checks. This could potentially lead to unauthorized access to sensitive information (Patchstack).

The vulnerability is considered moderately dangerous and is expected to become exploited. It requires low attack complexity and can be executed remotely with low privileges (Patchstack).

The vulnerability has been fixed in version 5.3.1 of the MyRewards plugin. Users are advised to update to this version or later immediately. For users unable to update immediately, Patchstack has issued a virtual patch to mitigate this issue by blocking potential attacks (Patchstack).