CVE-2024-5432: 
WordPress vulnerability analysis and mitigation

The Lifeline Donation plugin for WordPress contains an authentication bypass vulnerability (CVE-2024-5432) affecting versions up to and including 1.2.6. The vulnerability was discovered and disclosed on June 19, 2024, impacting the WordPress plugin ecosystem (NVD Database).

The vulnerability stems from insufficient verification of user authentication during the checkout process through the plugin. This security flaw has been assigned a CVSS v3.1 base score of 9.8 (Critical) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating a critical severity level. The vulnerability is classified under CWE-287 (Improper Authentication) (NVD Database).

The vulnerability allows unauthenticated attackers to log in as any existing user on the site, including administrators, if they have access to the email address. This presents a severe security risk as it could lead to complete site compromise through unauthorized administrative access (NVD Database).

Users of the Lifeline Donation plugin should immediately update to a version newer than 1.2.6 if available. If an update is not possible, it is recommended to disable the plugin until a patch can be applied (NVD Database).