CVE-2024-3609: 
WordPress vulnerability analysis and mitigation

The ReviewX – Multi-criteria Rating & Reviews for WooCommerce plugin for WordPress contains a vulnerability (CVE-2024-3609) related to unauthorized deletion of data. The vulnerability affects all versions up to and including 1.6.27, and was discovered due to a missing capability check on the reviewx_remove_guest_image function (NVD).

The vulnerability stems from a missing capability check in the reviewx_remove_guest_image function, which allows authenticated attackers with subscriber-level access or higher to delete attachments without proper authorization. The vulnerability has been assigned a CVSS v3.1 base score of 4.3 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N (NVD).

The vulnerability enables authenticated attackers with subscriber-level access or higher to delete attachments from the WordPress installation. This unauthorized deletion capability could lead to loss of data and potential disruption of website functionality (NVD).

The vulnerability requires authentication with at least subscriber-level access, making it somewhat limited in scope. However, once authenticated, the exploitation process is straightforward due to the missing capability check (NVD).

Users should update their ReviewX plugin to a version newer than 1.6.27 if available. The vulnerability has been identified and reported, suggesting that a patch should be implemented in newer versions (NVD).