CVE-2024-5204: 
WordPress vulnerability analysis and mitigation

The Swiss Toolkit For WP plugin for WordPress contains an authentication bypass vulnerability in versions up to and including 1.0.7. The vulnerability was discovered and disclosed in May 2024 (Wordfence).

The vulnerability stems from the plugin storing custom data in post metadata without an underscore prefix. This implementation flaw has been assigned a CVSS v3.1 base score of 8.8 HIGH (Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) (NVD).

The vulnerability allows authenticated attackers with contributor-level permissions or higher to log in as any existing user on the site, including administrators. This effectively enables privilege escalation and complete site compromise (Wordfence).

The vulnerability requires an attacker to have at least contributor-level access to the WordPress site. Once this condition is met, the attacker can exploit the improper metadata storage to gain unauthorized access to other user accounts (NVD).

Site administrators should immediately update the Swiss Toolkit For WP plugin to a version newer than 1.0.7. The vulnerability has been patched in subsequent releases (WordPress).