CVE-2024-34821: 
WordPress vulnerability analysis and mitigation

A Missing Authorization vulnerability was identified in Contact List PRO Contact List – Easy Business Directory, Staff Directory and Address Book Plugin affecting versions up to 2.9.87. The vulnerability was discovered by Dhabaleshwar Das and was published on May 9, 2024 (Patchstack).

The vulnerability is classified as a Broken Access Control issue with a CVSS v3.1 score of 5.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. The issue stems from missing authorization checks that could allow unprivileged users to execute certain higher privileged actions (Patchstack).

The vulnerability has been assessed as having a low severity impact and is considered unlikely to be exploited. It primarily affects the authorization mechanisms within the plugin, potentially allowing unauthorized access to certain functionalities (Patchstack).

The vulnerability requires no authentication to exploit, though specific details about exploitation methods have not been publicly disclosed. The issue was initially reported on January 13, 2024, and was published on May 9, 2024 (Patchstack).

Users are advised to update to version 2.9.88 or later to resolve the vulnerability. Additionally, Patchstack has issued a virtual patch to mitigate this issue by blocking potential attacks until users can update to the fixed version (Patchstack).