CVE-2024-3607: 
WordPress vulnerability analysis and mitigation

The PropertyHive plugin for WordPress (CVE-2024-3607) contains a vulnerability related to unauthorized loss of data, discovered and disclosed on May 2, 2024. The vulnerability affects all versions up to and including 2.0.12 of the PropertyHive plugin. This security issue stems from a missing capability check in the delete_key_date() function (NVD).

The vulnerability is characterized by a missing authorization check in the delete_key_date() function, which allows authenticated users with subscriber-level access or higher to perform unauthorized actions. The severity of this vulnerability has been assessed with a CVSS v3.1 Base Score of 4.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L. The vulnerability is classified under CWE-862 (Missing Authorization) (NVD).

When exploited, this vulnerability enables authenticated attackers with subscriber-level access or higher to delete arbitrary posts from the WordPress installation. This can result in unauthorized loss of data and potential disruption of website content (NVD).

The vulnerability requires authentication with at least subscriber-level access to exploit. The attack complexity is considered low, requiring no user interaction to execute, making it relatively straightforward to exploit for authenticated users (NVD).

Users are advised to update their PropertyHive plugin to version 2.0.13 or later, which contains the fix for this vulnerability. A patch has been made available through the WordPress plugin repository (WordPress Plugin).