CVE-2024-13637 is a missing authorization vulnerability (CWE-862) in the Demo Awesome WordPress plugin by romik84. The install_plugin function lacks proper capability checks, enabling authenticated users with low privileges (Subscriber and above) to install and activate arbitrary plugins. This could lead to unauthorized modification of the WordPress environment by escalating plugin management capabilities beyond intended permissions. The vulnerability affects all versions up to and including 1.0.3. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact.

An attacker with Subscriber-level access or higher can install and activate arbitrary plugins, potentially leading to unauthorized modification of the WordPress site’s functionality and integrity. This could allow privilege escalation or insertion of malicious code via plugins. There is no impact on confidentiality or availability reported. No known exploits are currently documented.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles to trusted users only and avoid granting Subscriber or higher privileges to untrusted accounts. Monitor for updates from the plugin vendor or WordPress security advisories for a patch or temporary mitigation.