The vulnerability identified as CVE-2024-2086 affects the 'File Manager for Google Drive – Integrate Google Drive' WordPress plugin by princeahmed. It arises from a missing capability check (CWE-862) on multiple AJAX calls, which leads to unauthorized access. Attackers without any privileges can exploit this to fully read, write, and delete files in the Google Drive account associated with the plugin, as well as modify plugin settings. This vulnerability impacts all plugin versions up to and including 1.3.8. The CVSS 3.1 base score is 10.0, reflecting network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability. No patch or official fix has been documented in the provided data.

Successful exploitation allows unauthenticated attackers to gain full read, write, and delete access to the Google Drive linked to the plugin, potentially leading to data theft, data loss, and unauthorized modification of plugin settings. This compromises the confidentiality, integrity, and availability of the Google Drive data managed through the plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider disabling the plugin or restricting access to the affected AJAX endpoints if possible. Monitor for updates from the vendor or security advisories for a patch or temporary mitigation.