CVE-2024-53795: 
WordPress vulnerability analysis and mitigation

A Missing Authorization vulnerability was identified in the Church Admin WordPress plugin, affecting versions up to 5.0.8. The vulnerability was discovered by researcher Kévin Mosbahi (Mika) and was publicly disclosed on December 2, 2024. The issue allows unauthorized access to functionality not properly constrained by Access Control Lists (ACLs) (Patchstack).

The vulnerability has been assigned CVE-2024-53795 and received a CVSS v3.1 score of 5.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L. The issue is classified under CWE-862 (Missing Authorization) and represents a broken access control vulnerability that could allow unprivileged users to execute higher privileged actions (Patchstack).

The vulnerability has been assessed as having a low severity impact. It affects the access control mechanisms of the Church Admin plugin, potentially allowing unauthorized users to access functionality that should be restricted (Patchstack).

The vulnerability has been fixed in version 5.0.9 of the Church Admin plugin. Users are advised to update to version 5.0.9 or later to remove the vulnerability. Patchstack users have the option to enable auto-update for vulnerable plugins (Patchstack).