CVE-2024-34442: 
WordPress vulnerability analysis and mitigation

A Missing Authorization vulnerability was discovered in weDevs weDocs WordPress plugin affecting versions through 2.1.4. The vulnerability was disclosed on May 7, 2024, and was assigned CVE-2024-34442. The issue has been patched in version 2.1.5 (Patchstack).

The vulnerability is classified as a Broken Access Control issue with a CVSS v3.1 Base Score of 5.3 (Medium) and vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. The vulnerability stems from missing authorization checks that could allow unprivileged users to execute certain higher privileged actions (Patchstack).

The security issue has been assessed as having a low severity impact and is considered unlikely to be exploited. The vulnerability could potentially allow unauthorized users to perform actions that should be restricted to users with higher privileges (Patchstack).

The vulnerability can be exploited by unauthenticated users, though specific exploit details have not been publicly disclosed. The issue was discovered and reported by security researcher Peng Zhou on March 30, 2024 (Patchstack).

Users are advised to update to version 2.1.5 or later to remediate this vulnerability. For users of Patchstack, a virtual patch has been issued to mitigate this issue by blocking potential attacks until the update can be applied (Patchstack).