CVE-2024-32804: 
WordPress vulnerability analysis and mitigation

CVE-2024-32804 is a Missing Authorization vulnerability affecting the WP GoToWebinar WordPress plugin through version 14.46. The vulnerability was discovered by Abdi Pranata and publicly disclosed on April 22, 2024. The affected software is Martin Gibson's WP GoToWebinar plugin, a WordPress integration tool (Patchstack).

The vulnerability is classified as a Missing Authorization/Broken Access Control issue with a CVSS v3.1 score of 4.3 (Medium). The security flaw stems from a missing capability check in the wp_gotowebinar_delete_log_callback() function. The vulnerability is tracked under CWE-862 (Missing Authorization) (WPScan).

This vulnerability allows authenticated attackers with subscriber-level access or higher to delete logs without proper authorization. The impact is primarily focused on unauthorized access to log management functionality (WPScan).

The vulnerability requires an authenticated user with at least subscriber-level privileges to exploit. The attack complexity is considered low, as it involves accessing functionality without proper authorization checks (Patchstack).

The vulnerability has been fixed in version 15.1 of the WP GoToWebinar plugin. Users are advised to update to this version or later to resolve the security issue. For users unable to update immediately, Patchstack has issued a virtual patch to mitigate this issue by blocking potential attacks (Patchstack).