CVE-2024-32786: 
WordPress vulnerability analysis and mitigation

Authentication Bypass by Spoofing vulnerability was discovered in WP Royal Royal Elementor Addons plugin affecting versions through 1.3.93. The vulnerability was disclosed on May 17, 2024, and was assigned CVE-2024-32786. This security issue allows functionality bypass in the WordPress plugin (Patchstack).

The vulnerability has been classified as an Authentication Bypass by Spoofing (CWE-290) issue. It received a CVSS v3.1 base score of 9.8 (CRITICAL) from NIST with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, while Patchstack assigned it a medium severity score of 5.3 with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N (Patchstack).

The vulnerability could allow an unauthenticated attacker to bypass certain restrictions in the code, potentially leading to unauthorized access to functionality (Patchstack).

The vulnerability can be exploited by unauthenticated attackers and requires no user interaction. The attack complexity is considered low, making it relatively straightforward to exploit (Patchstack).

Users are advised to update to version 1.3.95 or later to remediate this vulnerability. The security issue has been fixed in version 1.3.95 of the Royal Elementor Addons plugin (Patchstack).