The vulnerability CVE-2024-0370 involves improper access control (CWE-284) in the 'Views for WPForms' WordPress plugin. Specifically, the 'save_view' function lacks a capability check, enabling authenticated users with low privileges (subscriber and above) to modify post titles arbitrarily. This issue affects all plugin versions up to 3.2.2. The CVSS 3.1 base score is 4.3 (medium), reflecting network attack vector, low complexity, low privileges required, no user interaction, unchanged scope, no confidentiality or availability impact, and limited integrity impact. No patch or vendor advisory is currently provided, and no known exploits are reported in the wild.

Authenticated users with subscriber-level access or higher can modify the titles of arbitrary posts on the affected WordPress site. This represents an integrity impact but does not affect confidentiality or availability. The vulnerability could allow unauthorized content modification, potentially misleading site visitors or disrupting content management.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber-level user permissions where possible and monitor for unusual post title changes. Avoid granting unnecessary privileges to low-level users. Follow updates from the plugin vendor or WordPress security channels for a patch.