CVE-2024-5858: 
WordPress vulnerability analysis and mitigation

The AI Infographic Maker plugin for WordPress (CVE-2024-5858) contains a vulnerability related to unauthorized modification of data, discovered and disclosed on June 15, 2024. The vulnerability affects all versions up to and including 4.7.4. The issue stems from a missing capability check on the qcld_openai_title_generate_desc AJAX action (NVD).

The vulnerability is characterized by a missing capability check in the AJAX functionality, specifically in the qcld_openai_title_generate_desc action. It has been assigned a CVSS v3.1 base score of 4.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, indicating network accessibility, low attack complexity, and required low privileges (Wordfence).

The vulnerability allows authenticated attackers with Subscriber-level access or higher to update arbitrary post titles in WordPress installations running the affected plugin. This could lead to unauthorized modification of content on affected websites (NVD).

The vulnerability requires an authenticated user with at least Subscriber-level access to exploit. The attack can be executed remotely through network access, with low attack complexity and no user interaction required (Wordfence).

Users should update their AI Infographic Maker plugin to a version newer than 4.7.4 to address this vulnerability. The fix has been implemented in subsequent versions through proper capability checks (NVD).