CVE-2024-12028 describes a missing authorization vulnerability in the Friends plugin for WordPress by akirk. The issue arises from the absence of capability checks on multiple REST API endpoints, allowing unauthenticated attackers to perform actions such as sending arbitrary friend requests and accepting them on behalf of targeted websites. This unauthorized access could enable attackers to interact with the site as if they were accepted friends. The vulnerability affects all versions up to and including 3.2.1. The CVSS score of 5.3 reflects a medium impact primarily due to the ability to manipulate friend relationships without authentication.

The vulnerability allows unauthorized users to send and accept friend requests via the plugin's REST API, potentially enabling them to communicate with the targeted site as trusted friends. This could lead to unauthorized interactions or influence within the site’s friend network. There is no direct confidentiality or availability impact reported. No known exploits have been observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the Friends plugin or restricting access to its REST API endpoints to trusted users only. Monitor vendor channels for updates and apply any official patches promptly once available.