CVE-2024-32810: 
WordPress vulnerability analysis and mitigation

A Missing Authorization vulnerability was discovered in the ShortPixel Critical CSS WordPress plugin affecting versions through 1.0.2. The vulnerability was identified and published on April 22, 2024, and was assigned CVE-2024-32810 (Patchstack).

The vulnerability is classified as a Broken Access Control issue (CWE-862) due to missing capability checks on several functions. It received a CVSS v3.1 score of 7.6 (High), with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L. The vulnerability allows authenticated attackers with subscriber-level access or higher to perform unauthorized actions (WPScan).

The vulnerability enables authenticated users with subscriber-level privileges or higher to perform unauthorized actions that should be restricted to users with higher privilege levels. This represents a significant security breach in the access control mechanism of the plugin (Patchstack).

The vulnerability is known to be actively exploited in the wild. The attack requires low complexity and can be executed by an authenticated user with subscriber-level access (Patchstack).

Users are strongly advised to update to version 1.0.3 or later of the ShortPixel Critical CSS plugin, which contains the fix for this vulnerability. For users unable to update immediately, Patchstack has issued a virtual patch to mitigate this issue by blocking potential attacks (Patchstack).