CVE-2024-53799: 
WordPress vulnerability analysis and mitigation

A Missing Authorization vulnerability was identified in BAKKBONE Australia's FloristPress WordPress plugin, affecting versions up to 7.3.0. The vulnerability was discovered by Kévin Mosbahi (Mika) and was publicly disclosed on December 2, 2024. This security issue is related to incorrectly configured access control security levels that could lead to sensitive data exposure (Patchstack).

The vulnerability has been assigned CVE-2024-53799 and received a CVSS v3.1 score of 4.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. The issue is classified under CWE-862 (Missing Authorization) and requires subscriber-level privileges to exploit (Patchstack).

The vulnerability could allow a malicious actor with subscriber-level access to view sensitive information that is normally not available to regular users. This exposed data could potentially be used to exploit other weaknesses in the system (Patchstack).

The vulnerability has been patched in FloristPress version 7.4.0. Users are advised to update to version 7.4.0 or later to remove the vulnerability. Patchstack users have the option to enable auto-update for vulnerable plugins (Patchstack).