CVE-2024-43296: 
WordPress vulnerability analysis and mitigation

The Flash & HTML5 Video plugin for WordPress contains a Missing Authorization vulnerability (CVE-2024-43296) that affects versions up to and including 2.5.30. The vulnerability was discovered by Ananda Dhakal and publicly disclosed on August 16, 2024 (Patchstack).

The vulnerability is classified as a Missing Authorization (CWE-862) issue due to missing capability checks on several AJAX actions. The vulnerability has received varying CVSS v3.1 scores: NIST assigned a High severity score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), while Patchstack assigned a Medium severity score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) (NVD).

The vulnerability allows authenticated attackers with subscriber-level access and above to perform unauthorized actions including updating views and creating thumbnails (WPScan).

The vulnerability requires an authenticated user with at least subscriber-level privileges to exploit. The attack complexity is considered Low, requiring network access but no user interaction (NVD).

Users are advised to update to version 2.5.31 or later which contains the fix for this vulnerability. Patchstack has also issued a virtual patch to mitigate this issue by blocking potential attacks until users can update to the fixed version (Patchstack).