CVE-2024-32951: 
WordPress vulnerability analysis and mitigation

A Missing Authorization vulnerability was identified in BloomPixel Max Addons Pro for Bricks WordPress plugin, tracked as CVE-2024-32951. The vulnerability affects versions up to and including 1.6.1 of the Max Addons Pro for Bricks plugin. The issue was discovered by Dave Jong from Patchstack and was publicly disclosed on April 22, 2024 (Patchstack Report).

The vulnerability is classified as a Missing Authorization issue (CWE-862) that allows for unauthenticated plugin settings reset. It received a CVSS v3.1 base score of 6.5 (Medium), with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L. This scoring indicates that the vulnerability can be exploited over the network, requires low attack complexity, and needs no privileges or user interaction (Patchstack Report).

The vulnerability allows unauthenticated attackers to reset plugin settings, potentially disrupting the website's functionality and configuration. The CVSS scoring indicates low impacts on both integrity and availability of the system, with no direct impact on confidentiality (Patchstack Report).

The vulnerability is considered moderately dangerous and is expected to become exploited. The attack vector is network-accessible and requires no authentication, making it relatively easy to exploit (Patchstack Report).

Users are advised to update to version 1.6.2 or later to resolve the vulnerability. For Patchstack users, a virtual patch has been issued to mitigate this issue by blocking potential attacks until the update can be applied (Patchstack Report).