CVE-2024-5324: 
WordPress vulnerability analysis and mitigation

The Login/Signup Popup (Inline Form + Woocommerce) plugin for WordPress, versions 2.7.1 to 2.7.2, contains a vulnerability tracked as CVE-2024-5324. The vulnerability was discovered and disclosed on June 5, 2024, affecting the plugin's import_settings function due to a missing capability check (NVD CVE).

The vulnerability is classified as an Incorrect Authorization issue (CWE-863) with a CVSS v3.1 base score of 8.8 (HIGH). The vulnerability vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating network accessibility, low attack complexity, and requiring low privileges to exploit (NVD CVE).

The vulnerability allows authenticated attackers with Subscriber-level access or higher to modify arbitrary options on affected sites. Notably, attackers can exploit this to enable new user registration and set the default role for new users to Administrator, potentially leading to complete site compromise (NVD CVE).

The vulnerability requires an authenticated user with at least Subscriber-level access to exploit. The attack can be executed remotely with low complexity and does not require user interaction (NVD CVE).

Patches have been released to address this vulnerability. Site administrators should update their installations to the latest version of the plugin. The fix can be found in the WordPress plugin repository (WordPress Patch).