CVE-2024-10078 is a missing authorization vulnerability (CWE-862) in the WP Easy Post Types plugin for WordPress, developed by chertz. The issue arises from the absence of capability checks on multiple functions, enabling authenticated users with low privileges (subscriber-level and above) to perform unauthorized actions such as adding, modifying, or deleting plugin options and posts. This vulnerability affects all versions up to and including 1.4.4. The CVSS 3.1 base score is 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L), reflecting network attack vector, low attack complexity, and limited privileges required.

Exploitation of this vulnerability allows authenticated users with subscriber-level privileges or higher to bypass authorization controls and manipulate plugin settings and content. This can lead to unauthorized data modification, potential data loss, and integrity issues within the affected WordPress site. The impact includes limited confidentiality, integrity, and availability loss as indicated by the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles to trusted individuals and monitor for suspicious activity related to the WP Easy Post Types plugin. Avoid granting subscriber-level or higher access to untrusted users. Follow updates from the plugin vendor chertz for any forthcoming patches or official mitigations.