CVE-2024-10311 is an authentication bypass vulnerability in the External Database Based Actions plugin for WordPress, affecting versions up to 0.1. The issue arises from the absence of a capability check in the 'edba_admin_handle' function, enabling authenticated users with low privileges (subscriber-level and above) to escalate their privileges by updating plugin settings and logging in as any user on the site, including administrators. This vulnerability is classified under CWE-288 (Authentication Bypass Using an Alternate Path or Channel) and has a CVSS 3.1 base score of 7.5, indicating high severity. No patch or remediation guidance is currently provided by the vendor.

An attacker with subscriber-level access or higher can bypass authentication controls within the plugin to escalate privileges and impersonate any user, including administrators. This can lead to full site compromise, including unauthorized access to sensitive data and administrative functions. The vulnerability affects confidentiality, integrity, and availability as indicated by the CVSS vector (C:H/I:H/A:H).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to restrict subscriber-level access and monitor for suspicious activity related to this plugin. Consider disabling or removing the External Database Based Actions plugin if it is not essential to reduce risk.