CVE-2024-10861 is a missing authorization vulnerability (CWE-862) in the Popup Box – Create Countdown, Coupon, Video, Contact Form Popups WordPress plugin. The issue arises because the deactivate_plugin_option() function lacks a capability check, enabling unauthenticated users to update the 'ays_pb_upgrade_plugin' option with arbitrary data. This vulnerability affects all versions up to 4.9.7. The CVSS 3.1 score is 5.3 (medium severity), with attack vector network, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and no availability impact.

An attacker without authentication can modify plugin options arbitrarily, specifically the 'ays_pb_upgrade_plugin' option. This could lead to unauthorized changes in plugin behavior or configuration, potentially impacting the integrity of the plugin's operation. There is no direct confidentiality or availability impact reported. No known exploits have been observed in the wild.

Patch status is not yet confirmed — no official fix or patch is currently documented. Users should monitor the vendor's advisory channels for updates. Until a patch is released, restrict access to the WordPress installation and consider disabling or removing the vulnerable plugin if possible to reduce risk.