CVE-2024-12172 affects the WP Courses LMS plugin for WordPress, where the wpc_update_user_meta_option() function lacks proper authorization checks. This allows authenticated users with minimal privileges (Subscriber-level and above) to update arbitrary user metadata. By manipulating the wp_capabilities metadata, an attacker can revoke administrator privileges, effectively locking out site administrators. The vulnerability impacts all versions up to and including 3.2.21. The CVSS 3.1 base score is 7.5, reflecting a network attack vector with low attack complexity, no privileges required beyond subscriber, no user interaction, and high impact on integrity but no impact on confidentiality or availability. No patch or official fix has been documented yet.

An attacker with Subscriber-level access can modify arbitrary user metadata, including wp_capabilities, which can be used to remove administrator privileges. This can result in administrators being blocked from managing their WordPress site, impacting site integrity and administrative control. There is no indication of confidentiality or availability impact. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Subscriber-level access to trusted users only. Monitor for plugin updates from hookandhook and apply any official patches promptly once released. Avoid granting unnecessary privileges to users and consider additional access controls or plugin alternatives if possible.