CVE-2024-12327 is a missing authorization vulnerability (CWE-862) in the LazyLoad Background Images plugin for WordPress by proloybhaduri. The issue arises because the pblzbg_save_settings() function does not enforce capability checks, enabling authenticated users with minimal privileges (Subscriber and above) to update plugin settings. This could lead to unauthorized modification of plugin configuration but does not affect confidentiality or availability directly. The vulnerability affects all versions up to and including 1.0.7.

An attacker with at least Subscriber-level access to a WordPress site can modify the LazyLoad Background Images plugin settings without proper authorization. This unauthorized modification could potentially be used to alter plugin behavior or configuration, but there is no direct impact on data confidentiality or site availability reported. The CVSS score of 4.3 reflects a limited impact primarily on integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, site administrators should restrict user roles carefully to trusted users only and monitor plugin settings for unauthorized changes. Avoid granting Subscriber or higher privileges to untrusted users. Follow updates from the plugin vendor for any forthcoming patches.