CVE-2024-11643 is a high-severity vulnerability in the Accessibility by AllAccessible WordPress plugin caused by a missing capability check in the 'AllAccessible_save_settings' function. This authorization bypass enables authenticated users with low privileges (Subscriber or above) to update arbitrary WordPress options. Attackers can leverage this to escalate privileges by setting the default registration role to administrator and enabling user registration, thereby gaining administrative access to the site. The vulnerability affects all versions up to and including 1.3.4. There is no patch or official fix currently available, and no known exploits in the wild have been reported.

Successful exploitation allows an authenticated low-privilege user to escalate their privileges to administrator by modifying site options, including the default user role and registration settings. This compromises the integrity, confidentiality, and availability of the WordPress site, potentially allowing full administrative control by an attacker.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles to trusted users only and consider disabling or removing the Accessibility by AllAccessible plugin if possible. Monitor for updates from the vendor and apply patches promptly once available.