The vulnerability CVE-2024-12594 affects the 'Login Page Styler – Custom WordPress Login Page Customizer & Security' plugin by zia-imtiaz. It is caused by a missing capability check on the AJAX action 'lps_generate_temp_access_url', allowing authenticated users with low privileges (Subscriber-level) to escalate privileges by generating temporary access URLs to log in as other users. This flaw exists in all plugin versions up to and including 7.1.1. The CVSS 3.1 base score is 8.8, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or official remediation guidance is currently available.

Successful exploitation allows authenticated users with minimal privileges to impersonate other users, potentially gaining unauthorized access to sensitive information and administrative functions. This compromises the confidentiality, integrity, and availability of the affected WordPress site. The vulnerability can lead to full site takeover depending on the privileges of the targeted user accounts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, it is recommended to restrict access to the plugin's AJAX actions if possible, limit user roles that can authenticate, or disable the plugin to prevent exploitation. Monitor official vendor channels for updates and apply patches promptly once released.