CVE-2024-13687 describes a missing authorization vulnerability in the Team Builder – Meet the Team WordPress plugin (versions up to 1.3). The save_team_builder_options() function lacks proper capability checks, enabling authenticated users with minimal privileges (Subscriber and above) to update plugin settings. This vulnerability is categorized under CWE-862 (Missing Authorization) and has a CVSS 3.1 base score of 4.3, reflecting a medium severity with network attack vector, low complexity, and no impact on confidentiality or availability but limited impact on integrity.

An attacker with authenticated access at Subscriber level or higher can modify the plugin's settings without proper authorization. This could lead to unauthorized changes in the plugin configuration, potentially affecting site behavior or security depending on how the plugin settings are used. There is no direct impact on confidentiality or availability reported. No known exploits are currently in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix has been published, administrators should monitor for updates from the plugin vendor. As a temporary measure, restrict Subscriber-level access where possible or disable the plugin until a fix is available.