CVE-2024-0829 is a missing authorization vulnerability (CWE-862) in the Comments Extra Fields For Post,Pages and CPT WordPress plugin affecting all versions up to and including 5.0. The issue arises from missing or incorrect capability checks on multiple AJAX actions, enabling authenticated users with subscriber or higher privileges to invoke these actions improperly. This can lead to unauthorized modification of comment form fields and plugin settings. The vulnerability has a CVSS 3.1 base score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), reflecting a network attack vector with low complexity but requiring low privileges and no user interaction, impacting integrity but not confidentiality or availability.

An authenticated attacker with subscriber-level access or higher can exploit this vulnerability to modify comment form fields and update plugin settings without proper authorization. This impacts the integrity of the plugin's configuration and comment form data. There is no indication of confidentiality or availability impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles and permissions to trusted users only and monitor for unusual changes to comment form fields or plugin settings. Avoid granting subscriber or higher privileges to untrusted users. Follow updates from the plugin vendor for any forthcoming patches or official fixes.