CVE-2024-1850 is a missing authorization vulnerability (CWE-862) in the kekotron AI Post Generator | AutoWriter WordPress plugin. The plugin fails to perform proper capability checks on AJAX-hooked functions, enabling authenticated users with subscriber or higher privileges to manipulate posts generated by the plugin. This includes unauthorized viewing of unpublished posts, creation and publishing of new posts, and deletion of posts. The vulnerability affects all versions up to and including 3.3. The CVSS 3.1 base score is 6.3, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and impacts on confidentiality, integrity, and availability.

An attacker with subscriber-level access can bypass intended authorization controls to view unpublished posts, create and publish new posts, or delete existing posts generated by the plugin. This compromises the confidentiality, integrity, and availability of content managed by the plugin. The impact is limited to authenticated users with at least subscriber privileges and does not allow unauthenticated remote exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber-level access where possible and monitor user privileges. Consider disabling or removing the plugin if unauthorized post manipulation poses a significant risk.