CVE-2024-54381: 
WordPress vulnerability analysis and mitigation

A Missing Authorization vulnerability was identified in theDotstore Advance Menu Manager WordPress plugin, affecting versions up to 3.1.1. The vulnerability was discovered by researcher stealthcopter and was publicly disclosed on December 11, 2024. This security issue has been assigned CVE-2024-54381 (Patchstack).

The vulnerability has been classified as CWE-862 (Missing Authorization). It received a CVSS v3.1 Base Score of 7.1 (High) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L. The vulnerability requires subscriber-level privileges to exploit (NVD, Patchstack).

The vulnerability allows authenticated users with subscriber-level access or higher to modify settings in the Advance Menu Manager plugin. This could potentially lead to high-impact integrity compromises and low-impact availability issues in the affected WordPress installations (Patchstack).

The vulnerability is considered highly dangerous and is expected to become mass exploited. It requires low attack complexity and can be exploited remotely by an authenticated user with subscriber-level access (Patchstack).

Users are advised to update to version 3.1.2 or later of the Advance Menu Manager plugin to resolve this vulnerability. For users of Patchstack, a virtual patch has been issued to mitigate this issue by blocking potential attacks until the update can be applied (Patchstack).