CVE-2024-37111: 
WordPress vulnerability analysis and mitigation

A Missing Authorization vulnerability was discovered in the WordPress WishList Member X plugin, identified as CVE-2024-37111. The vulnerability affects versions before 3.26.7 and was publicly disclosed on June 20, 2024. The issue was discovered by security researcher Dave Jong from Patchstack (Patchstack Advisory).

The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (High), with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The issue is classified under CWE-862 (Missing Authorization) and allows for unauthenticated denial of service attacks against affected WordPress installations (Patchstack Advisory).

The vulnerability can lead to a denial of service condition, where malicious actors can cause the website to crash or become unresponsive to legitimate user requests. This can result in service disruption for affected WordPress sites running the vulnerable plugin versions (Patchstack Advisory).

The vulnerability can be exploited by unauthenticated attackers, requiring no special privileges or user interaction. The attack vector is network-accessible, making it relatively straightforward to exploit (Patchstack Advisory).

Users are advised to update to WishList Member X version 3.26.7 or later to resolve the vulnerability. Patchstack has issued a virtual patch to mitigate this issue by blocking potential attacks until users can update to the fixed version (Patchstack Advisory).