CVE-2024-32778: 
WordPress vulnerability analysis and mitigation

A Missing Authorization vulnerability (CVE-2024-32778) was identified in the WordPress Contest Gallery plugin affecting versions through 21.3.4. The vulnerability was discovered by CatFather and publicly disclosed on April 22, 2024 (Patchstack).

The vulnerability has been assigned a CVSS v3.1 base score of 8.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H. The issue is classified as CWE-862 (Missing Authorization) and allows for arbitrary file deletion when exploited (Patchstack).

If exploited, this vulnerability could allow a malicious actor to delete files from the affected website. The deletion of core files could potentially cause the site to break and stop functioning. The vulnerability requires author-level privileges or higher to exploit (Patchstack).

The vulnerability is known to be exploitable and requires author-level privileges. According to security researchers, this vulnerability is moderately dangerous and is expected to become actively exploited (Patchstack).

The vulnerability has been fixed in version 21.3.5 of the Contest Gallery plugin. Users are advised to update to this version or later immediately. For temporary mitigation, Patchstack has issued a virtual patch to block potential attacks until users can update to the fixed version (Patchstack).