CVE-2024-1385: CWE-862 Missing Authorization in usability_dynamics WP-Stateless – Google Cloud Storage
The WP-Stateless – Google Cloud Storage plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the dismiss_notices() function in all versions up to, and including, 3.4.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to update arbitrary option values to the current time, which may completely take a site offline.
AI Analysis
Technical Summary
CVE-2024-1385 is a missing authorization vulnerability (CWE-862) in the WP-Stateless – Google Cloud Storage plugin for WordPress. The flaw exists in the dismiss_notices() function, which lacks proper capability checks, allowing authenticated users with low privileges (subscriber-level and above) to modify option values arbitrarily. This can lead to a denial of service by effectively taking the WordPress site offline. The vulnerability affects all versions up to and including 3.4.0. The CVSS 3.1 base score is 7.1, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and high availability impact. A patch is available to fix this issue.
Potential Impact
An attacker with subscriber-level access or higher can exploit this vulnerability to update arbitrary option values, which may cause the WordPress site to become unavailable. This results in a denial of service condition impacting site availability. There is no direct confidentiality impact, but integrity and availability are affected.
Mitigation Recommendations
A patch is available for this vulnerability. Site administrators should update the WP-Stateless – Google Cloud Storage plugin to the latest version beyond 3.4.0 to remediate the missing authorization issue. Until patched, restrict user roles to trusted users only and monitor for suspicious activity related to option value changes.
CVE-2024-1385: CWE-862 Missing Authorization in usability_dynamics WP-Stateless – Google Cloud Storage
Description
The WP-Stateless – Google Cloud Storage plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the dismiss_notices() function in all versions up to, and including, 3.4.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to update arbitrary option values to the current time, which may completely take a site offline.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2024-1385 is a missing authorization vulnerability (CWE-862) in the WP-Stateless – Google Cloud Storage plugin for WordPress. The flaw exists in the dismiss_notices() function, which lacks proper capability checks, allowing authenticated users with low privileges (subscriber-level and above) to modify option values arbitrarily. This can lead to a denial of service by effectively taking the WordPress site offline. The vulnerability affects all versions up to and including 3.4.0. The CVSS 3.1 base score is 7.1, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and high availability impact. A patch is available to fix this issue.
Potential Impact
An attacker with subscriber-level access or higher can exploit this vulnerability to update arbitrary option values, which may cause the WordPress site to become unavailable. This results in a denial of service condition impacting site availability. There is no direct confidentiality impact, but integrity and availability are affected.
Mitigation Recommendations
A patch is available for this vulnerability. Site administrators should update the WP-Stateless – Google Cloud Storage plugin to the latest version beyond 3.4.0 to remediate the missing authorization issue. Until patched, restrict user roles to trusted users only and monitor for suspicious activity related to option value changes.
Technical Details
- Data Version
- 5.1
- Assigner Short Name
- Wordfence
- Date Reserved
- 2024-02-08T21:00:39.214Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 699f6d2db7ef31ef0b56ea47
Added to database: 2/25/2026, 9:44:13 PM
Last enriched: 4/9/2026, 1:36:43 PM
Last updated: 4/12/2026, 3:34:32 PM
Views: 12
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.