CVE-2024-1844 describes a missing authorization vulnerability (CWE-862) in the RevivePress – Keep your Old Content Evergreen WordPress plugin by infosatech. The vulnerability arises from the absence of capability checks on the import_data and copy_data functions in all versions up to and including 1.5.6. This allows authenticated users with subscriber-level privileges or higher to overwrite and view plugin settings without proper authorization. The CVSS 3.1 base score is 4.3 (medium), reflecting the network attack vector, low complexity, and limited impact on integrity without confidentiality or availability impact. No vendor patch or advisory is currently available, and no exploits are known in the wild.

Authenticated users with subscriber-level access or higher can exploit this vulnerability to modify and view plugin settings that should be restricted. This could lead to unauthorized changes in plugin behavior or configuration, potentially affecting site functionality or security posture. There is no impact on confidentiality or availability reported. No known active exploitation has been observed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles to trusted individuals only and monitor plugin usage closely. Avoid granting subscriber-level or higher access to untrusted users. Follow vendor communications for updates on patches or official mitigations.