CVE-2024-12614 is an SQL Injection vulnerability in the coder426 Passwords Manager WordPress plugin. The issue arises from missing capability checks on the 'pms_save_setting' and 'post_new_pass' AJAX actions, enabling authenticated users with low privileges (Subscriber-level and above) to modify plugin settings and add passwords. This vulnerability affects all versions up to and including 1.4.8. The CVSS 3.1 base score is 7.5, reflecting a high severity due to network attack vector, low attack complexity, and no required privileges for exploitation beyond subscriber access.

An attacker with Subscriber-level access or higher can exploit this vulnerability to modify plugin settings and add passwords without authorization. This could lead to unauthorized data modification within the plugin's scope. The vulnerability does not directly indicate impact on confidentiality or availability but allows unauthorized configuration changes, which may compromise security controls related to password management.

No patch or official fix information is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict Subscriber-level access to trusted users only and monitor for suspicious activity related to the Passwords Manager plugin's AJAX actions. Consider disabling or removing the plugin if it is not essential.