CVE-2024-0617 is a missing authorization vulnerability (CWE-862) in the vidishp Simple Discount Rules for Woocommerce WordPress plugin. The issue arises from the lack of a capability check in the wpcd_save_discount() function, which handles saving discount data. This allows unauthenticated attackers to modify product category discounts, potentially impacting the integrity of pricing and revenue. The vulnerability affects all versions up to and including 4.12. The CVSS 3.1 base score is 5.3 (medium severity) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, indicating network attack vector, low attack complexity, no privileges or user interaction required, no confidentiality or availability impact, but integrity impact is low.

An attacker without authentication can modify product category discount data, which may lead to unauthorized discount changes and potential financial loss for the affected e-commerce site. There is no impact on confidentiality or availability reported. The integrity of discount configurations is compromised.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected plugin's endpoints and consider disabling the plugin if possible. Monitor plugin updates from vidishp for a security patch addressing this authorization issue.