CVE-2024-1861 is a missing authorization vulnerability (CWE-862) in the Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan WordPress plugin by sminozzi. The issue arises because the antihacker_truncate_scan_table() function lacks a capability check, enabling authenticated users with subscriber-level privileges or higher to truncate the scan table. This improper access control can lead to unauthorized modification of plugin data. The vulnerability affects all versions up to 4.52 and has a CVSS 3.1 base score of 4.3 (medium severity). No patch or official remediation guidance is currently available.

Authenticated users with subscriber-level access or higher can truncate the scan table within the plugin, leading to unauthorized modification of plugin data. This could interfere with the plugin's ability to track or manage security scans, potentially reducing its effectiveness. There is no indication of direct confidentiality or availability impact beyond this data modification. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting subscriber-level user capabilities or monitoring for unusual activity related to the plugin's scan table. Avoid granting unnecessary authenticated access to untrusted users. Follow updates from the plugin vendor for any forthcoming patches.