CVE-2024-56253: 
WordPress vulnerability analysis and mitigation

A Missing Authorization vulnerability was identified in the Data Tables Generator by Supsystic WordPress plugin, affecting versions up to 1.10.36. The vulnerability was discovered by researcher Aiden (Thái An) on November 18, 2024, and was publicly disclosed on December 30, 2024. This security issue has been assigned CVE-2024-56253 and is classified as a Broken Access Control vulnerability (Patchstack).

The vulnerability is categorized as CWE-862 (Missing Authorization) and has received a CVSS v3.1 base score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L. The issue stems from a broken access control problem where there is a missing authorization, authentication, or nonce token check in a function that could allow an unprivileged user to execute higher privileged actions (NVD, Patchstack).

The vulnerability has been assessed with a low severity impact, though it could potentially allow unprivileged users to perform actions that should be restricted to users with higher privileges. The CVSS scoring indicates potential impacts on integrity and availability, while confidentiality remains unaffected (Patchstack).

The vulnerability has been fixed in version 1.10.37 of the Data Tables Generator by Supsystic plugin. Users are advised to update to version 1.10.37 or later to remove the vulnerability. Patchstack users have the option to enable auto-update for vulnerable plugins (Patchstack).