CVE-2024-11085 is a missing authorization vulnerability (CWE-862) in the maxwellberkel WP Log Viewer WordPress plugin. The issue arises because the plugin fails to enforce capability checks on multiple AJAX actions, enabling authenticated users with minimal privileges (Subscriber-level and above) to access sensitive plugin logs and modify user and general plugin settings. This vulnerability affects all versions up to and including 1.2.1. The CVSS 3.1 score is 5.4 (medium), reflecting the network attack vector, low attack complexity, and limited impact on confidentiality and integrity without availability impact.

Authenticated attackers with Subscriber-level privileges or higher can exploit this vulnerability to access plugin logs and change plugin-related user and general settings without proper authorization. This could lead to unauthorized disclosure of potentially sensitive log information and unauthorized configuration changes within the plugin context. There is no indication of impact on system availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles to trusted individuals only and monitor plugin usage closely. Avoid granting Subscriber-level or higher access to untrusted users. Review and limit access to the WP Log Viewer plugin functionalities where possible.