CVE-2024-50422: 
WordPress vulnerability analysis and mitigation

A Missing Authorization vulnerability has been identified in Cloudways Breeze WordPress plugin affecting versions up to 2.1.14. The vulnerability was discovered and reported by Rafie Muhammad, and was officially assigned CVE-2024-50422 on October 24, 2024 (Patchstack).

The vulnerability is classified as a Broken Access Control issue (CWE-862) with a CVSS v3.1 Base Score of 5.3 (Medium), and vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L. The security flaw stems from missing authorization checks that could allow exploiting incorrectly configured access control security levels (NVD).

The vulnerability allows unprivileged users to execute certain higher privileged actions due to broken access control mechanisms. While the specific impact varies case by case, the overall severity is considered low and is unlikely to be exploited (Patchstack).

The vulnerability has been fixed in version 2.1.15 of the Breeze plugin. Users are recommended to update to version 2.1.15 or later to remove the vulnerability. Patchstack users can enable auto-update for vulnerable plugins as an additional security measure (Patchstack).