CVE-2024-0828 describes a missing authorization (CWE-862) vulnerability in the Play.ht – Make Your Blog Posts Accessible With Text to Speech Audio WordPress plugin by hammadh. In all versions up to and including 3.6.4, the plugin fails to enforce proper capability checks on multiple functions. This flaw permits authenticated users with subscriber or higher privileges to delete, retrieve, or modify post metadata, access contents of protected posts, modify conversion data, and delete article audio. The vulnerability has a CVSS 3.1 base score of 5.4 (medium severity) with network attack vector, low attack complexity, and privileges required at the low level.

An attacker with subscriber-level access or higher can abuse the missing authorization to manipulate post metadata, access protected post content, modify conversion data, and delete audio articles. This could lead to unauthorized data disclosure and integrity issues within the affected WordPress site. There is no indication of availability impact. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber-level access carefully and monitor for suspicious activity related to the Play.ht plugin. Avoid granting unnecessary privileges to users. Follow vendor updates for any forthcoming patches or official fixes.