CVE-2024-54354: 
WordPress vulnerability analysis and mitigation

A Missing Authorization vulnerability was discovered in Beat Kueffer Termin-Kalender WordPress plugin, identified as CVE-2024-54354. The vulnerability affects versions through 0.99.47 and was disclosed on December 12, 2024. This security issue allows for Stored XSS attacks in the plugin (Patchstack).

The vulnerability is classified as a Broken Access Control issue with a CVSS score of 6.5 (Medium). The security flaw stems from missing authorization checks that could allow unprivileged users with Subscriber-level access or higher to execute certain higher-privileged actions. The vulnerability has been assigned CWE-862 (Missing Authorization) (NVD, Patchstack).

The vulnerability is considered moderately dangerous and is expected to become exploited. It could allow authenticated users with low-level privileges to perform unauthorized actions typically reserved for users with higher privileges (Patchstack).

Users are advised to update to version 1.00.04 or later which contains the fix for this vulnerability. For temporary mitigation, Patchstack has issued a virtual patch to block potential attacks until users can update to the fixed version (Patchstack).