CVE-2024-1095 is a missing authorization vulnerability in the Build & Control Block Patterns – Boost up Gutenberg Editor plugin for WordPress. The issue arises from the absence of a capability check in the settings_export() function, allowing unauthenticated users to export plugin settings. This vulnerability affects all versions up to and including 1.3.5.4. The CVSS 3.1 score of 5.3 reflects a medium severity with network attack vector, low attack complexity, no privileges required, no user interaction, and limited confidentiality impact. No patch or remediation details are currently available from the vendor or other sources.

An unauthenticated attacker can export the plugin's settings, potentially exposing configuration data. The confidentiality impact is limited, and there is no impact on integrity or availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the plugin's export functionality by limiting access to trusted users or disabling the plugin if feasible.