CVE-2024-12617 identifies a missing authorization vulnerability in the WC Price History for Omnibus WordPress plugin, versions up to and including 2.1.3. The issue arises from the absence of capability checks on multiple AJAX actions, enabling authenticated users with low privileges (Subscriber-level and above) to access and modify sensitive price history data. This vulnerability is categorized under CWE-862, reflecting improper enforcement of access control. The CVSS 3.1 score of 5.4 reflects a network attack vector with low complexity and no user interaction required, but limited impact on confidentiality and integrity. No patch or vendor advisory is currently available, and the plugin is not a cloud service.

Authenticated users with Subscriber-level access or higher can bypass intended access controls to view and alter price history data managed by the plugin. This could lead to unauthorized data disclosure and data integrity issues within the affected WordPress site. There is no indication of availability impact or exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to the affected AJAX endpoints by custom code or limiting plugin usage to trusted users only. Monitor for updates from the plugin author or WordPress security advisories.