CVE-2024-1352 is a missing authorization vulnerability (CWE-862) in the Classified Listing – AI-Powered Classified ads & Business Directory Plugin for WordPress by techlabpro1. The issue arises from the lack of capability checks in the rtcl_import_location() and rtcl_import_category() functions, allowing authenticated users with subscriber-level privileges or higher to create terms improperly. This affects all versions up to 3.0.4. The vulnerability is remotely exploitable over the network with low attack complexity and no user interaction required, impacting confidentiality and integrity but not availability.

An attacker with subscriber-level access or higher can create or modify terms in the plugin without proper authorization. This could lead to unauthorized data modification and potential information disclosure within the affected WordPress site. There is no indication of availability impact or known exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber-level user capabilities where possible and monitor for suspicious activity related to term creation. Avoid granting unnecessary privileges to low-level authenticated users.