CVE-2024-37276: 
WordPress vulnerability analysis and mitigation

The Featured Image from URL (FIFU) WordPress plugin contains a Missing Authorization vulnerability identified as CVE-2024-37276. This security issue affects versions up to and including 4.8.1, and was discovered by Rafie Muhammad. The vulnerability was publicly disclosed on June 28, 2024 (Patchstack).

The vulnerability is classified as a Missing Authorization (CWE-862) issue that allows exploiting incorrectly configured access control security levels. The vulnerability has received a CVSS v3.1 score of 5.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. The issue specifically involves the fifusavesizes_api() function which lacks proper capability checks (WPScan).

The vulnerability enables unauthenticated attackers to update size settings in the plugin. This represents a broken access control issue where unprivileged users can execute actions that should be restricted to users with higher privileges (Patchstack).

The vulnerability has been patched in version 4.8.2 of the Featured Image from URL plugin. Users are advised to update to version 4.8.2 or later to remediate this security issue (Patchstack).