CVE-2024-13651 identifies a missing authorization vulnerability in the RapidLoad AI – Optimize Web Vitals Automatically WordPress plugin (versions up to 2.4.4). The ajax_deactivate() function lacks a capability check, enabling authenticated users with low privileges (Subscriber and above) to modify plugin settings by resetting them. This unauthorized modification can impact the integrity of the plugin's configuration but does not affect confidentiality or availability. The vulnerability is rated medium severity with a CVSS score of 4.3 and does not have a known public exploit or vendor-provided patch at this time.

An attacker with at least Subscriber-level access can reset certain plugin settings without authorization, potentially disrupting the intended configuration of the RapidLoad plugin. This could lead to degraded plugin performance or altered behavior but does not directly compromise data confidentiality or availability. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles to trusted individuals only and monitor for unauthorized changes to plugin settings. Avoid granting Subscriber-level or higher access to untrusted users.