CVE-2024-37430: 
WordPress vulnerability analysis and mitigation

The Patreon WordPress plugin for WordPress contains an Authentication Bypass by Spoofing vulnerability (CVE-2024-37430) that affects all versions up to and including 1.9.0. The vulnerability was discovered and disclosed on June 28, 2024, and allows unauthenticated attackers to bypass image locking protections when a specific header is supplied (WPScan, Patchstack).

The vulnerability is classified as a Protection Mechanism Bypass with a CVSS v3.1 Base Score of 5.3 (Medium) and vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. It is categorized under CWE-290 (Authentication Bypass by Spoofing) and OWASP Top 10 A5: Broken Access Control. The issue stems from the plugin's failure to properly validate authentication when specific headers are present (Patchstack).

The vulnerability allows unauthenticated attackers to bypass image locking protections in the Patreon WordPress plugin. This could potentially expose protected content that was intended to be restricted (WPScan).

The vulnerability has a low complexity (AC:L) and requires no privileges (PR:N) or user interaction (UI:N) to exploit. It can be accessed over the network, making it remotely exploitable (Patchstack).

The vulnerability has been fixed in version 1.9.1 of the Patreon WordPress plugin. Users are advised to update to this version or later to remove the vulnerability. The security issue is considered to have a low severity impact and is unlikely to be exploited (Patchstack).