CVE-2024-13439 is a missing authorization vulnerability (CWE-862) in the Team – Team Members Showcase Plugin for WordPress by techlabpro1. The issue arises because the response() function does not perform capability checks, enabling authenticated users with low privileges (Subscriber and above) to modify plugin settings. This vulnerability affects all plugin versions up to and including 4.4.9. The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low attack complexity, requiring privileges but no user interaction, and impacts integrity with no confidentiality or availability impact.

An attacker with Subscriber-level access or higher can update the plugin's settings without proper authorization. This could lead to unauthorized changes in plugin behavior or configuration, potentially affecting site functionality or security posture. There is no direct impact on confidentiality or availability reported. No known exploits are currently active in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles to trusted individuals only and monitor for unusual changes in plugin settings. Avoid granting Subscriber or higher privileges to untrusted users. Follow the vendor's updates for any forthcoming patches or official mitigations.