CVE-2024-13358 is a missing authorization vulnerability (CWE-862) in the themekraft BuddyPress WooCommerce My Account Integration plugin for WordPress. The issue arises from the lack of a capability check in the wc4bp_delete_page() function, enabling authenticated users with low privileges (Subscriber and above) to update plugin page settings improperly. This vulnerability affects all plugin versions up to and including 3.4.24. The CVSS 3.1 base score is 4.3 (medium), reflecting network attack vector, low complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and no availability impact. No known exploits or patches are currently documented.

Authenticated users with Subscriber-level access or higher can modify plugin page settings without proper authorization. This could lead to unauthorized changes in the plugin configuration, potentially affecting site behavior or user experience. There is no direct confidentiality or availability impact reported. The integrity impact is limited to the plugin's page settings.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict plugin usage to trusted users only and monitor for unusual changes in plugin page settings. Avoid granting Subscriber or higher roles to untrusted users. Follow vendor updates closely for an official fix.