CVE-2024-37107: 
WordPress vulnerability analysis and mitigation

An Improper Privilege Management vulnerability was discovered in the WordPress WishList Member X plugin, identified as CVE-2024-37107. The vulnerability affects versions before 3.26.7 and was publicly disclosed on June 20, 2024. This security flaw allows authenticated users with subscriber-level access or higher to perform privilege escalation attacks (Patchstack).

The vulnerability has been assigned a CVSS v3.1 base score of 8.8 (High) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. This indicates that the vulnerability can be exploited over the network, requires low attack complexity, needs low privileges, requires no user interaction, and can result in high impacts to confidentiality, integrity, and availability (Patchstack).

The vulnerability could allow malicious actors to escalate their low-privileged account to one with higher privileges. If successfully exploited, attackers could potentially gain full control of the website if high privileges are obtained (Patchstack).

The vulnerability requires an authenticated user with at least subscriber-level access to exploit. Due to its high CVSS score and low complexity, it is expected to become mass exploited (Patchstack).

The vulnerability has been patched in version 3.26.7 of the WishList Member X plugin. Users are strongly advised to update to this version or later immediately. For users unable to update immediately, Patchstack has issued a virtual patch to mitigate this issue by blocking potential attacks (Patchstack).