CVE-2024-33594: 
WordPress vulnerability analysis and mitigation

A Missing Authorization vulnerability was identified in the Leaky Paywall WordPress plugin, affecting versions up to 4.20.8. The vulnerability was discovered by Joshua Chan on January 16, 2024, and was publicly disclosed on April 25, 2024. This security issue has been assigned CVE-2024-33594 (Patchstack Database).

The vulnerability is classified as a Broken Access Control issue (CWE-862) with a CVSS v3.1 base score of 7.5 (High). The vulnerability vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, indicating that it can be exploited over the network with low attack complexity, requires no privileges or user interaction, and can result in high impact to integrity (Patchstack Database).

The vulnerability allows for price manipulation within the Leaky Paywall plugin. As a broken access control issue, it could potentially allow unprivileged users to execute higher privileged actions (Patchstack Database).

The vulnerability can be exploited by unauthenticated users, though it has been classified as having a low patch priority. No active exploits have been reported in the wild (Patchstack Database).

The vulnerability has been fixed in version 4.20.9 of the Leaky Paywall plugin. Users are advised to update to version 4.20.9 or later to remove the vulnerability (Patchstack Database).