CVE-2024-27953 describes a missing authorization vulnerability in the Cool Plugins Cryptocurrency Widgets – Price Ticker & Coins List plugin, affecting versions through 2.6.8. The vulnerability allows actions or access without proper authorization controls, categorized under CWE-862. The CVSS score of 4.7 reflects a medium severity with network attack vector, low attack complexity, and requiring high privileges but no user interaction. No official fix or patch has been released, and no known exploits have been reported. The plugin is not cloud-hosted, so remediation requires vendor patching or user updates.

The vulnerability could allow an attacker with high privileges to perform unauthorized actions or access data within the affected plugin, potentially leading to limited confidentiality, integrity, and availability impacts. The medium CVSS score reflects that exploitation requires high privileges and does not involve user interaction, limiting the scope of impact. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should restrict access to high-privilege accounts and monitor for updates from Cool Plugins. No specific temporary mitigations are provided by the vendor at this time.