CVE-2024-10294 is a missing authorization vulnerability (CWE-862) in the CE21 Suite WordPress plugin, specifically in the 'ce21_single_sign_on_save_api_settings' function. This missing capability check enables unauthenticated attackers to alter plugin settings, potentially impacting the integrity and availability of the plugin's functionality. The vulnerability affects versions up to and including 2.2.0. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, low integrity impact, and low availability impact.

An attacker without authentication can modify plugin settings, which may lead to unauthorized changes affecting the plugin's operation. While confidentiality is not impacted, integrity and availability impacts are rated low. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the WordPress admin interface and consider disabling or removing the CE21 Suite plugin if it is not essential. Monitor for updates from the vendor regarding patches or official mitigations.