CVE-2024-32802: 
WordPress vulnerability analysis and mitigation

A Missing Authorization vulnerability was discovered in WordPlus BP Better Messages plugin affecting versions through 2.4.32. The vulnerability was disclosed on May 17, 2024, and allows unauthorized access to functionality that should be properly constrained by Access Control Lists (ACLs) (Patchstack).

The vulnerability has been assigned a CVSS v3.1 base score of 5.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. It is classified as CWE-862 (Missing Authorization) and can be exploited by unauthenticated attackers (Patchstack).

This vulnerability can be exploited by malicious actors to perform actions that should normally only be executable by higher privileged users. The potential impact includes the possibility of attackers gaining administrative access to the affected WordPress website (Patchstack).

The vulnerability requires no authentication to exploit and has a low attack complexity. It can be accessed remotely through the network vector (Patchstack).

Users are advised to update to BP Better Messages version 2.4.33 or later to resolve this vulnerability. Patchstack has issued a virtual patch to mitigate this issue by blocking potential attacks until users can update to a fixed version (Patchstack).