CVE-2024-7380: 
WordPress vulnerability analysis and mitigation

The Geo Controller plugin for WordPress (versions up to and including 8.6.9) contains a missing authorization vulnerability identified as CVE-2024-7380. The vulnerability affects the ajax__geolocate_menu and ajax__geolocate_remove_menu functions, which lack proper capability checks (NVD).

The vulnerability is classified as a Missing Authorization issue (CWE-862) with a CVSS v3.1 base score of 4.3 MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N). The vulnerability exists in the menu management functions of the plugin, specifically in the ajax__geolocate_menu and ajax__geolocate_remove_menu functions (Wordfence).

The vulnerability allows authenticated attackers with Subscriber-level access or higher to create or delete WordPress menus without proper authorization. This could lead to unauthorized manipulation of the website's navigation structure (NVD).

The vulnerability requires an authenticated user with at least Subscriber-level access to exploit. The attack complexity is considered low, requiring no user interaction to execute (Wordfence).

Users should update to a version newer than 8.6.9 when available. Until then, site administrators should carefully monitor menu changes and consider restricting user roles that have access to the affected functionality (NVD).