CVE-2024-1175 is a missing authorization vulnerability (CWE-862) in the WP-Recall – Registration, Profile, Commerce & More WordPress plugin. The vulnerability arises because the 'delete_payment' function lacks a capability check, enabling unauthenticated users to delete arbitrary payment data. This affects all versions up to 16.26.6. The CVSS 3.1 base score is 5.3 (medium severity), with attack vector network, low attack complexity, no privileges required, no user interaction, and impact limited to availability (deletion of payment data). No patch or official fix is currently documented.

An attacker without authentication can delete payment records arbitrarily, causing loss of payment data and potentially disrupting commerce functionality. There is no confidentiality or integrity impact reported, but availability is affected due to unauthorized deletion of data. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the plugin's functionality where possible and monitor for unusual deletion activity. Avoid exposing the affected endpoints publicly if feasible.