CVE-2024-10673 is a missing authorization vulnerability (CWE-862) in the themehunk Top Store WordPress theme affecting all versions up to 1.5.4. The vulnerability arises from the lack of a capability check in the top_store_install_and_activate_callback() function, enabling authenticated users with subscriber-level privileges or higher to install arbitrary plugins. These plugins could contain further vulnerabilities, potentially allowing privilege escalation and remote code execution. The CVSS v3.1 base score is 8.8, reflecting high impact on confidentiality, integrity, and availability. No patch or vendor advisory is currently available, and the product is not a cloud service.

An attacker with at least subscriber-level access can exploit this vulnerability to install arbitrary plugins on the affected WordPress site. This can lead to privilege escalation and remote code execution, compromising the confidentiality, integrity, and availability of the site. The high CVSS score (8.8) indicates a significant risk if exploited. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles to trusted individuals only and monitor for suspicious plugin installations. Avoid granting subscriber-level or higher access to untrusted users. Follow updates from themehunk for an official patch or temporary workaround.