CVE-2024-1860 is a missing authorization vulnerability in the WordPress plugin 'Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan' (all versions up to 4.51). The vulnerability exists because the antihacker_add_whitelist() function does not perform a capability check, allowing unauthenticated attackers to add their IP addresses to the whitelist. This unauthorized modification can circumvent the plugin's security protections designed to block malicious activity. The CVSS 3.1 score is 6.5 (medium severity), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and partial confidentiality and integrity impact.

An attacker can bypass the plugin's security protections by adding their IP address to the whitelist without authentication. This could allow them to evade detection or blocking mechanisms implemented by the plugin, potentially facilitating further malicious actions on the WordPress site. The impact affects confidentiality and integrity but does not affect availability. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should consider disabling the plugin or restricting access to the affected functionality through other means. Monitoring for plugin updates from the vendor is recommended to apply any forthcoming patches promptly.