CVE-2024-31099 is classified as CWE-862 (Missing Authorization) in the Averta Shortcodes and extra features for the Phlox theme, specifically auxin-elements. It affects versions up to 2.15.7 and allows an attacker with low privileges to bypass authorization controls, potentially leading to unauthorized information disclosure and modification. The vulnerability has a CVSS 3.1 base score of 6.4, with network attack vector, low attack complexity, low privileges required, no user interaction, and scope changed. No official patch or vendor advisory is currently available to confirm remediation status.

The vulnerability can lead to unauthorized access and modification of data within the affected plugin, impacting confidentiality and integrity. There is no impact on availability. Since the attack requires low privileges and no user interaction, it could be leveraged by authenticated users to escalate their capabilities or access restricted functionality. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected plugin features to trusted users only and monitor for suspicious activity related to authorization bypass attempts. Avoid granting unnecessary privileges to users who can interact with the plugin.