The vulnerability CVE-2024-1072 in the SeedProd Website Builder plugin arises from a missing capability check in the seedprod_lite_new_lpage function. This flaw permits unauthenticated attackers to alter page content for coming-soon, maintenance, login, and 404 pages configured via the plugin. The issue affects all versions up to 6.15.21. Although version 6.15.22 patched the authorization bypass, it introduced a bug impacting admin pages. The subsequent release, 6.15.23, resolves both the authorization vulnerability and the admin page bug. The CVSS 3.1 base score is 8.2, indicating high severity with network attack vector, no privileges required, no user interaction, and high impact on integrity with low impact on availability.

Successful exploitation allows unauthenticated attackers to modify the content of critical pages such as coming-soon, maintenance, login, and 404 pages on affected WordPress sites using the SeedProd plugin. This can lead to unauthorized content changes, potentially misleading visitors or disrupting site operations. There is no direct confidentiality impact reported. The vulnerability has a high integrity impact and low availability impact. No known exploits in the wild have been reported at this time.

A fix is available. Users should upgrade the Website Builder by SeedProd plugin to version 6.15.23, which addresses the missing authorization check and resolves the admin page bug introduced in version 6.15.22. Applying this update is the recommended remediation. Patch status is confirmed by the vendor's versioning information. No additional mitigations are specified or required beyond upgrading to the fixed version.