CVE-2024-10124 describes an improper access control vulnerability in the Vayu Blocks WordPress plugin by themehunk. The tp_install() function lacks a capability check, enabling unauthenticated attackers to install and activate arbitrary plugins. This can be leveraged for remote code execution if other vulnerable plugins are installed. The vulnerability affects all versions up to and including 1.1.1, with only a partial patch applied in 1.1.1. No full remediation or patch link is currently provided. The CVSS 3.1 score is 9.8 (critical), reflecting network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows unauthenticated attackers to install and activate arbitrary WordPress plugins, potentially leading to remote code execution if other vulnerable plugins are present. This compromises the confidentiality, integrity, and availability of the affected WordPress site. The vulnerability is critical and can be exploited remotely without authentication or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Version 1.1.1 includes only a partial patch, so upgrading to this version may reduce risk but does not fully mitigate the vulnerability. Until a full fix is released, restrict access to plugin installation functions and monitor for suspicious activity. Avoid installing untrusted plugins that could be leveraged in combination with this vulnerability.