CVE-2024-54278: 
WordPress vulnerability analysis and mitigation

A Missing Authorization vulnerability was identified in the News Ticker for Elementor WordPress plugin, affecting versions through 2.1.3. The vulnerability was discovered by Marek Mikita and was publicly disclosed on December 11, 2024. The issue has been assigned CVE-2024-54278 and relates to broken access control where functionality is not properly constrained by ACLs (Patchstack).

The vulnerability has been assigned a CVSS v3.1 Base Score of 4.3 (Medium) with the following vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. The issue is classified under CWE-862 (Missing Authorization) and requires Subscriber-level privileges to exploit (NVD, Patchstack).

The vulnerability is classified as having a low severity impact. It involves broken access control that could potentially allow an unprivileged user to execute certain higher privileged actions (Patchstack).

The vulnerability requires Subscriber-level privileges to exploit and is considered unlikely to be exploited due to its low severity impact (Patchstack).

Currently, no official fix is available for this vulnerability. The issue was initially reported on October 15, 2024, and an early warning was sent to Patchstack customers on December 11, 2024 (Patchstack).