CVE-2024-10674 is a missing authorization vulnerability (CWE-862) in the Th Shop Mania WordPress theme affecting all versions up to 1.4.9. The vulnerability arises from the lack of a capability check in the th_shop_mania_install_and_activate_callback() function, enabling authenticated users with low privileges (Subscriber-level and above) to install arbitrary plugins. This unauthorized plugin installation can be leveraged to execute remote code and escalate privileges within the affected WordPress environment. The CVSS 3.1 base score is 8.8, reflecting high impact on confidentiality, integrity, and availability. No patch or official remediation has been documented in the provided information.

An attacker with at least Subscriber-level access can install arbitrary plugins, which may lead to remote code execution and privilege escalation. This compromises the confidentiality, integrity, and availability of the affected WordPress site. The vulnerability significantly increases the attack surface by allowing unauthorized plugin installation, potentially enabling further exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles to trusted individuals only and consider disabling or removing the Th Shop Mania theme if possible. Monitor for updates from the themehunk vendor regarding a security patch or official mitigation.