The vulnerability CVE-2024-13530 in the zia-imtiaz Custom Login Page Styler WordPress plugin is due to missing capability checks on the functions lps_handle_delete_all_logs(), lps_handle_delete_login_log(), and lps_handle_end_session(). This allows authenticated users with Subscriber-level privileges or higher to perform unauthorized actions such as deleting login logs and ending user sessions. The issue affects all versions up to 7.1.1. The CVSS 3.1 base score is 4.3 (medium severity), with an attack vector of network, low attack complexity, requiring low privileges, no user interaction, and impact limited to integrity. There is no vendor advisory or patch information provided, and no known exploits have been reported.

An authenticated attacker with Subscriber-level access or above can delete login logs and terminate user sessions without proper authorization. This could hinder forensic investigations or audit trails and disrupt user sessions, impacting integrity but not confidentiality or availability. There is no indication of privilege escalation or remote unauthenticated exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Subscriber-level access to trusted users only and monitor for suspicious activity related to login log deletion or session termination. Avoid granting unnecessary privileges to users. Follow updates from the plugin vendor for an official fix.