CVE-2024-10786 is a missing authorization vulnerability (CWE-862) in the Simple Local Avatars plugin for WordPress. The issue arises because the sla_clear_user_cache function lacks a capability check, enabling authenticated users with minimal privileges (Subscriber or above) to clear user caches. This could lead to unauthorized modification of cached data. The vulnerability affects all versions up to 2.7.11. The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low attack complexity, requiring low privileges, no user interaction, and impacting integrity only.

An attacker with Subscriber-level access or higher can clear user caches without authorization, potentially causing unauthorized modification of cached data. There is no impact on confidentiality or availability reported. No known exploits are currently in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles to trusted users only and monitor for suspicious activity related to cache clearing. Avoid granting Subscriber or higher privileges to untrusted users.