CVE-2024-34768: 
WordPress vulnerability analysis and mitigation

A Missing Authorization vulnerability (CVE-2024-34768) was discovered in the WordPress Fastly plugin affecting versions through 1.2.25. The vulnerability was reported by Joshua Chan on April 18, 2024, and was publicly disclosed on May 17, 2024 (Patchstack).

The vulnerability is classified as a Broken Access Control issue (CWE-862) with a CVSS v3.1 base score of 5.3 (Medium), and vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. The issue stems from missing authorization checks in certain plugin functions, which could allow unprivileged users to execute actions typically reserved for users with higher privileges (Patchstack).

The vulnerability has been assessed as having a low severity impact. It could potentially allow subscriber-level users to perform unauthorized actions, though the specific impact varies case by case (Patchstack).

The vulnerability requires subscriber-level access to exploit and is considered unlikely to be exploited due to its low severity impact (Patchstack).

The vulnerability has been fixed in version 1.2.26 of the Fastly plugin. Users are advised to update to version 1.2.26 or later to remove the vulnerability. Patchstack users have the option to enable auto-updates for vulnerable plugins (Patchstack).