The vulnerability identified as CVE-2024-2172 involves a missing critical step in authentication (CWE-304) within the mo_wpns_init() function of MiniOrange's Malware Scanner and Web Application Firewall WordPress plugins. This flaw permits unauthenticated attackers to escalate their privileges to administrator by bypassing capability checks. It affects all plugin versions up to 4.7.2 (Malware Scanner) and 2.1.1 (Web Application Firewall). The CVSS 3.1 base score of 9.8 reflects the high severity due to ease of exploitation over the network without authentication and the potential for complete system compromise.

Successful exploitation allows unauthenticated attackers to gain administrator privileges on affected WordPress sites, leading to full control over the site, including confidentiality, integrity, and availability impacts. This could result in site defacement, data theft, or further malicious activity. No known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected plugins and consider disabling them if possible. Monitor official MiniOrange channels for updates and apply patches promptly once released.