CVE-2024-0683 is a missing authorization vulnerability (CWE-862) in the Bulgarisation for WooCommerce plugin for WordPress, affecting all versions up to and including 3.0.14. The vulnerability arises from the absence of proper capability checks on several functions, enabling unauthorized users, including unauthenticated attackers and those with subscriber-level privileges, to generate and delete labels within the plugin. This can lead to unauthorized modification of plugin data. The CVSS 3.1 base score is 7.3 (High), with attack vector network, low attack complexity, no privileges required, no user interaction, and impacts on confidentiality, integrity, and availability.

Successful exploitation allows attackers without proper authorization to generate and delete labels in the plugin, potentially impacting data integrity, confidentiality, and availability within the affected WordPress site. This could disrupt normal plugin operations and affect e-commerce functionality relying on these labels.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles to trusted users only and monitor for suspicious activity related to label generation and deletion. Avoid granting subscriber-level or higher access to untrusted users. Follow updates from the vendor or WordPress plugin repository for any forthcoming patches.