CVE-2024-1687 is a missing authorization vulnerability in the Thank You Page Customizer for WooCommerce – Increase Your Sales WordPress plugin, affecting all versions up to 1.1.2. The issue arises because the get_text_editor_content() function does not verify user capabilities before allowing execution of shortcodes. As a result, any authenticated user with subscriber-level privileges or higher can execute arbitrary shortcodes, potentially leading to limited impact on confidentiality and integrity. The vulnerability has a CVSS 3.1 base score of 5.4 (medium severity), with network attack vector, low attack complexity, and no user interaction required.

An attacker with subscriber-level access or above can exploit this vulnerability to execute arbitrary shortcodes within the WordPress environment. This could lead to limited confidentiality and integrity impacts, such as unauthorized content injection or manipulation within the plugin's context. There is no indication of availability impact or privilege escalation beyond the existing user role. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles to trusted users only and consider disabling or removing the vulnerable plugin if feasible. Monitor vendor channels for updates and apply any official patches promptly once available.