CVE-2024-12596 is a missing authorization vulnerability (CWE-862) in the LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes WordPress plugin, affecting all versions up to and including 7.8.5. The issue arises because the plugin fails to verify user capabilities when processing the 'llms_delete_cert' action, allowing authenticated users with minimal privileges (Subscriber-level and above) to delete arbitrary posts. This flaw impacts the integrity of content managed by the plugin but does not affect confidentiality or availability. The CVSS 3.1 base score is 4.3, reflecting a medium severity level.

Authenticated users with Subscriber-level privileges or higher can delete arbitrary posts within the WordPress site using the vulnerable LifterLMS plugin. This compromises data integrity by enabling unauthorized content removal. There is no direct impact on confidentiality or availability according to the CVSS vector. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix links are provided, users should monitor the vendor's announcements for updates. Until a fix is available, consider restricting Subscriber-level permissions or disabling the plugin if feasible to mitigate risk.