CVE-2024-1042 is a missing authorization vulnerability (CWE-862) in the WP Radio plugin for WordPress. The plugin fails to enforce capability checks on several AJAX functions, enabling authenticated users with subscriber or higher privileges to perform unauthorized modifications such as importing radio stations, deleting countries, and changing plugin settings. This vulnerability affects all versions up to and including 3.1.9. It has a CVSS 3.1 base score of 6.4, indicating a medium severity impact. No patch or remediation details are currently provided by the vendor.

Exploitation allows authenticated users with low privileges (subscriber and above) to modify plugin data without authorization. This can lead to unauthorized changes in the plugin's configuration and content, potentially impacting the integrity of the radio station listings and settings. The vulnerability does not directly cause denial of service or data confidentiality loss but can facilitate further attacks such as Cross-Site Scripting (tracked separately under CVE-2024-1041).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber-level access and above to trusted users only. Monitor plugin updates from the vendor for a security patch addressing this missing authorization issue.