CVE-2024-6883: 
WordPress vulnerability analysis and mitigation

The Event Espresso 4 Decaf – Event Registration Event Ticketing plugin for WordPress contains a vulnerability (CVE-2024-6883) that allows unauthorized plugin settings modification. The vulnerability affects all versions up to and including 5.0.22.decaf and was discovered in August 2024. The issue has been assigned a CVSS score of 4.3 (Medium) (Wordfence).

The vulnerability stems from a missing capability check on the saveTimezoneString function and several other functions in the plugin. This security flaw is classified as CWE-862 (Missing Authorization) (NVD). The vulnerability has been assigned a CVSS v3.1 base score of 4.3, with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, indicating network accessibility, low attack complexity, and low privileges required (Wordfence).

The vulnerability allows authenticated attackers with Subscriber-level access or higher to modify certain plugin settings. While the impact is limited to specific plugin settings, it represents an unauthorized elevation of privileges for lower-level users (NVD).

The vulnerability requires authentication at the Subscriber level or higher to exploit. The attack complexity is considered low, requiring no user interaction to execute (Wordfence).

Users should update to a version newer than 5.0.22.decaf if available. No specific workarounds have been publicly documented (NVD).