CVE-2024-1337 is a missing authorization vulnerability (CWE-862) in the SKT Page Builder WordPress plugin by sonalsinha21. The issue arises from the lack of capability checks in the 'saveSktbuilderPageData' function, enabling authenticated users with subscriber or higher privileges to inject arbitrary content into pages. This vulnerability affects all versions up to and including 4.1. The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low attack complexity and requiring low privileges but no user interaction. The impact is limited to integrity, with no confidentiality or availability impact reported. No known exploits in the wild have been documented, and no patch or remediation details are currently available.

An attacker with subscriber-level access or higher can modify page content without proper authorization, potentially injecting arbitrary content. This compromises the integrity of the affected web pages but does not affect confidentiality or availability. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles to trusted individuals only and monitor for unauthorized content changes. Avoid granting subscriber or higher privileges to untrusted users. Follow updates from the plugin vendor for any forthcoming patches or official fixes.