CVE-2024-12620 describes a missing authorization vulnerability in the AnimateGL Animations for WordPress plugin, specifically affecting the 'agl_json' AJAX action. Because the plugin does not verify user capabilities before processing this action, unauthenticated attackers can update plugin settings. This issue affects all versions up to and including 1.4.23 and is categorized under CWE-862. The vulnerability has a CVSS 3.1 base score of 5.3, indicating a medium severity impact primarily on integrity without affecting confidentiality or availability.

An attacker without authentication can modify the plugin's settings, potentially altering the behavior or appearance of animations on the WordPress site. This unauthorized modification impacts the integrity of the plugin's configuration but does not directly disclose sensitive information or cause denial of service. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should consider restricting access to AJAX endpoints or disabling the plugin if possible. Monitoring plugin updates from the vendor is recommended to apply any forthcoming patches promptly.