CVE-2024-10664 is a missing authorization vulnerability (CWE-862) in the BasePress Docs WordPress plugin, affecting all versions up to and including 2.16.3.3. The issue arises from the lack of a capability check in the basepress_db_posts_update() function, enabling authenticated users with low privileges (Subscriber and above) to update database entries unauthorized. The vulnerability has a CVSS 3.1 base score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), reflecting network attack vector, low attack complexity, and limited privileges required, resulting in limited integrity impact without confidentiality or availability impact. No patch or vendor advisory is currently provided.

An attacker with at least Subscriber-level access to a WordPress site using the affected BasePress Docs plugin can modify database content without proper authorization. This could lead to unauthorized content changes within the documentation or wiki managed by the plugin. There is no impact on confidentiality or availability reported. No known active exploitation has been observed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict user roles to trusted individuals only and monitor for unauthorized content changes. Avoid granting Subscriber-level or higher access to untrusted users. Follow updates from the plugin vendor or WordPress plugin repository for official patches or mitigations.