CVE-2024-32797: 
WordPress vulnerability analysis and mitigation

A Missing Authorization vulnerability was discovered in the WP LinkedIn Auto Publish WordPress plugin, affecting versions through 8.11. The vulnerability was reported by Abdi Pranata and was assigned CVE-2024-32797. The issue was disclosed on April 22, 2024, and has been classified as a broken access control vulnerability (Patchstack).

The vulnerability has been assigned a CVSS v3.1 base score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L. The issue is categorized under CWE-862 (Missing Authorization) and requires subscriber-level privileges to exploit (Patchstack).

The broken access control vulnerability could allow an unprivileged user to execute certain higher privileged actions. The specific impact varies case by case, but the overall severity is considered low to medium based on the CVSS score (Patchstack).

The vulnerability requires subscriber-level privileges to exploit and has been assessed as having a low likelihood of exploitation. The attack complexity is considered low, requiring network access but with low privileges (Patchstack).

The vulnerability has been fixed in version 8.12 of the WP LinkedIn Auto Publish plugin. Users are advised to update to version 8.12 or later to remediate the issue. Patchstack has also issued a virtual patch to mitigate this issue by blocking potential attacks until users can update to the fixed version (Patchstack).