CVE-2024-2508 is a missing authorization vulnerability (CWE-862) in the WP Mobile Menu plugin for WordPress, affecting all versions up to 2.8.4.4. The issue arises from the absence of a capability check in the save_menu_item_icon function, enabling unauthenticated attackers to add or modify the '_mobmenu_icon' post meta on arbitrary posts. Although version 2.8.4.4 contains a partial fix, no complete patch has been confirmed. The vulnerability has a CVSS 3.1 base score of 5.3, reflecting low attack complexity and no privileges required, but only integrity impact without confidentiality or availability effects.

The vulnerability allows unauthenticated attackers to modify post metadata by adding the '_mobmenu_icon' meta key with sanitized values. This unauthorized data modification could affect the integrity of the affected WordPress sites using the vulnerable plugin. There is no impact on confidentiality or availability reported. No known exploits are currently observed in the wild.

As of now, no full official patch is confirmed for this vulnerability. Version 2.8.4.4 includes a partial fix, but users should monitor the vendor's advisory for updates and apply any forthcoming official fixes promptly. Until a complete patch is available, consider restricting access to plugin functionality or disabling the plugin if feasible to reduce exposure.