CVE-2024-10860 is a missing authorization vulnerability (CWE-862) in the NextMove Lite – Thank You Page for WooCommerce plugin for WordPress. The issue arises from the lack of a capability check in the _submit_uninstall_reason_action() function, enabling authenticated users with Subscriber-level privileges or above to submit uninstall reasons without proper authorization. This vulnerability affects all versions up to and including 2.19.0. The CVSS 3.1 base score is 4.3 (medium), reflecting low complexity and limited impact on integrity only. No known exploits are reported in the wild, and no patch or official fix has been documented in the provided data.

The vulnerability allows authenticated users with low-level privileges (Subscriber and above) to submit uninstall reasons on behalf of the site without proper authorization. This does not affect confidentiality or availability but impacts the integrity of uninstall reason data. There is no indication of further privilege escalation or broader system compromise based on the available information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting Subscriber-level user capabilities or monitoring for unusual uninstall reason submissions. Avoid granting unnecessary privileges to low-level users. No official patch or workaround is currently documented in the provided data.