CVE-2024-12616 affects Bitly's WordPress Plugin by lacking capability checks on multiple AJAX actions, enabling authenticated users with low privileges (Subscriber-level and above) to update and access plugin settings improperly. This missing authorization vulnerability (CWE-862) can lead to unauthorized modification of plugin data. The issue impacts all versions up to 2.7.3. The CVSS score of 4.3 reflects a medium severity with network attack vector, low attack complexity, and privileges required at the low level.

An attacker with authenticated Subscriber-level access or higher can modify and retrieve Bitly plugin settings without proper authorization. This could lead to unauthorized changes in plugin configuration, potentially affecting the plugin's behavior or integration with Bitly services. There is no indication of direct confidentiality or availability impact, and no known exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Subscriber-level access to trusted users only and monitor for unusual activity related to the Bitly plugin settings. Avoid granting unnecessary privileges to low-level authenticated users.