CVE-2024-6869: 
WordPress vulnerability analysis and mitigation

The Falang multilanguage for WordPress plugin is affected by an unauthorized modification vulnerability (CVE-2024-6869) in versions up to and including 1.3.52. The vulnerability was disclosed on August 8, 2024, and affects the plugin's data handling capabilities (NVD).

The vulnerability stems from missing capability checks on several functions within the plugin. This security flaw has been assigned a CVSS v3.1 base score of 7.1 (HIGH) by NVD and 5.4 (MEDIUM) by Wordfence, with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N. The vulnerability is classified as CWE-862: Missing Authorization (NVD).

The vulnerability allows authenticated attackers with Subscriber-level access or higher to perform unauthorized actions including updating and deleting translations. Additionally, attackers can expose the administrator email address, potentially compromising sensitive information (NVD).

The vulnerability requires an authenticated user with at least Subscriber-level access to exploit. The attack complexity is considered low, requiring no user interaction to execute (NVD).

Users are advised to update to versions after 1.3.52 which contain the security fix. A patch has been made available to address this vulnerability (WordPress Patch).