CVE-2024-5641: 
WordPress vulnerability analysis and mitigation

The One Click Order Re-Order plugin for WordPress contains a vulnerability (CVE-2024-5641) due to a missing capability check on the 'ced_ocor_save_general_setting' function in versions up to and including 1.1.9. This security flaw was discovered and reported by Wordfence (Wordfence Advisory).

The vulnerability stems from insufficient access control in the plugin's settings functionality. The missing capability check in the 'ced_ocor_save_general_setting' function allows authenticated users with Subscriber-level access or higher to modify plugin settings. The vulnerability has been assigned a CVSS v3.1 base score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (NVD).

The vulnerability allows authenticated attackers with Subscriber-level privileges to modify plugin settings and potentially inject stored cross-site scripting payloads. This could lead to unauthorized changes to the plugin's configuration and potential execution of malicious scripts (NVD).

The vulnerability requires an authenticated user with at least Subscriber-level access to exploit. The attack complexity is low, requiring only the ability to send requests to modify plugin settings (NVD).

Users should update to version 1.1.10 or later of the One Click Order Re-Order plugin which includes a fix for this vulnerability. The patch can be found in the WordPress plugin repository (WordPress Plugin).