CVE-2024-27190 describes a Missing Authorization vulnerability in the Jean-David Daviet Download Media plugin, versions up to 1.4.2. This vulnerability arises because the plugin fails to properly verify whether a user has the necessary permissions before allowing certain actions, potentially enabling unauthorized access to download media resources. The CVSS 3.1 score of 4.3 reflects a network attack vector with low complexity, requiring low privileges and no user interaction, impacting confidentiality but not integrity or availability. No patch or official remediation level has been disclosed, and no exploits are known in the wild. The vulnerability is documented by Patchstack and publicly published as of March 21, 2024.

The vulnerability could allow an attacker with low privileges to access or download media resources without proper authorization, potentially exposing confidential information. There is no indication of impact on data integrity or system availability. No active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the Download Media plugin features to trusted users only. Monitor for vendor updates or security advisories that may provide patches or further mitigation instructions.