The vulnerability CVE-2024-31246 affects the WPXPO PostX plugin up to version 3.2.3. It is a missing authorization issue where access control security levels are incorrectly configured, allowing users with limited privileges to perform actions or access data they should not be authorized for. The CVSS v3.1 base score is 5.4 (medium), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and partial impact on confidentiality and integrity without affecting availability.

Successful exploitation could lead to unauthorized disclosure or modification of data within the PostX plugin context. The impact is limited to confidentiality and integrity with no availability impact. Since the attack requires low privileges, it could be leveraged by authenticated users with limited access to escalate their capabilities or access restricted content.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit access to trusted users and monitor for unusual activity related to PostX plugin usage. Avoid granting unnecessary privileges to users who can interact with the plugin.