CVE-2024-54267: 
WordPress vulnerability analysis and mitigation

A Missing Authorization vulnerability was discovered in the CM Answers WordPress plugin, affecting versions up to and including 3.2.6. The vulnerability was reported on December 10, 2024, by security researcher Muhammad Zidan Ali Mansur. The issue stems from missing capability checks in the plugin's functionality (Patchstack, WPScan).

The vulnerability is classified as CWE-862 (Missing Authorization) and has been assigned a CVSS v3.1 score of 4.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. The issue relates to broken access control where certain functions lack proper authorization checks (Patchstack).

The vulnerability allows authenticated users with Subscriber-level access and above to perform unauthorized actions within the plugin's functionality. The severity is considered low to medium, as it requires an authenticated user to exploit (WPScan).

The vulnerability requires an authenticated user with at least Subscriber-level access to exploit. The risk is considered low priority, and exploitation is deemed unlikely according to security assessments (Patchstack).

The vulnerability has been fixed in version 3.2.7 of the CM Answers plugin. Users are advised to update to this version or later to remediate the security issue. No alternative workarounds have been provided (Patchstack).