CVE-2024-11840 is a missing authorization vulnerability in the RapidLoad AI – Optimize Web Vitals Automatically WordPress plugin by shakee93. The issue arises because several functions (including uucss_data, update_rapidload_settings, wp_ajax_update_htaccess_file, uucss_update_rule, upload_rules, get_all_rules, update_titan_settings, preload_page, and activate_module) do not enforce proper capability checks. This allows authenticated users with low privileges (Subscriber-level and above) to modify plugin settings or potentially conduct SQL injection attacks. The vulnerability affects all versions up to and including 2.4.2. The CVSS 3.1 base score is 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N), reflecting network attack vector, low attack complexity, and partial impact on confidentiality and integrity.

An attacker with at least Subscriber-level access can exploit this vulnerability to modify plugin settings or conduct SQL injection attacks, potentially leading to unauthorized data access or manipulation. The confidentiality impact is high, integrity impact is low, and availability is not affected. This could compromise the security posture of the affected WordPress site by allowing privilege escalation within the plugin's context.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Subscriber-level access and higher privileges to trusted users only. Monitor for plugin updates from the vendor and apply any official patches promptly once available.