CVE-2024-33937: 
WordPress vulnerability analysis and mitigation

A Missing Authorization vulnerability was identified in Nico Martin Progressive WordPress (PWA) plugin affecting versions through 2.1.13. The vulnerability was discovered and reported by Abdi Pranata, and was assigned CVE-2024-33937. This security issue was publicly disclosed on April 29, 2024 (Patchstack).

The vulnerability is classified as a Missing Authorization (CWE-862) issue. It received a CVSS v3.1 Base Score of 4.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. The security flaw allows authenticated attackers with subscriber-level access and above to perform unauthorized actions (WPScan).

The vulnerability enables authenticated users with subscriber-level privileges or higher to execute unauthorized actions within the WordPress installation. This represents a broken access control issue that could potentially lead to unauthorized access to protected functionality (Patchstack).

The vulnerability requires an authenticated user with at least subscriber-level access to exploit. As of the disclosure date, there is no public information about active exploitation in the wild (Patchstack).

Currently, there is no official fix available for this vulnerability. Website administrators running affected versions of the Progressive WordPress (PWA) plugin should consider implementing additional access controls or temporarily disabling the plugin until a patch is released (Patchstack).