CVE-2024-1177 describes a missing authorization vulnerability in the WP Club Manager WordPress plugin (up to version 2.2.10). Specifically, the settings_save() function lacks a capability check, enabling unauthenticated attackers to update the permalink structure for clubs. This unauthorized modification could impact the integrity of the plugin's configuration but does not affect confidentiality or availability. The vulnerability has a CVSS 3.1 base score of 5.3 (medium severity). No official patch or remediation guidance is currently provided by the vendor, and no exploits are known in the wild.

An attacker without authentication can modify the permalink structure for clubs within the plugin, potentially causing unauthorized changes to site configuration. This impacts the integrity of the plugin's data but does not disclose sensitive information or cause denial of service. The vulnerability could be leveraged to alter site behavior or URLs related to clubs, possibly affecting site navigation or SEO.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the WordPress admin area and monitor for unusual changes to permalink settings. Consider disabling or removing the plugin if not essential. Avoid exposing the WordPress admin interface to untrusted networks.