CVE-2024-12018 affects the aliakro Snippet Shortcodes plugin for WordPress, where missing authorization controls allow authenticated users with low privileges (Subscriber-level and above) to delete shortcodes. The plugin uses a nonce for authentication, but the nonce value is leaked, bypassing intended protections. This vulnerability is present in all versions up to and including 4.1.6. The CVSS 3.1 base score is 4.3, reflecting a network attack vector, low attack complexity, requiring privileges, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and no availability impact.

An attacker with at least Subscriber-level access can delete shortcodes in the plugin, potentially disrupting website functionality that relies on these shortcodes. There is no direct confidentiality or availability impact reported. The integrity impact is limited to the deletion of shortcode data managed by the plugin.

No official patch or fix is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict user roles to minimize exposure, and monitor for suspicious shortcode deletions. Avoid granting Subscriber-level or higher access to untrusted users.