CVE-2024-32683 describes an authorization bypass vulnerability in the Wpmet Wp Ultimate Review WordPress plugin up to version 2.2.5. The issue arises from improper authorization checks that can be bypassed using a user-controlled key, categorized as CWE-639 (Authorization Bypass Through User-Controlled Key). The vulnerability has a CVSS v3.1 base score of 5.3, reflecting network attack vector, low complexity, no privileges or user interaction required, and limited confidentiality impact. No vendor advisory or patch is currently available, and the plugin is not a cloud service, so remediation depends on vendor updates.

The vulnerability allows an attacker to bypass authorization controls, potentially accessing or manipulating data or functionality without proper permissions. The impact is limited to confidentiality loss with no integrity or availability impact reported. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary workaround is currently available, users should monitor for updates from the Wpmet vendor. Until a patch is released, consider restricting access to the affected plugin or disabling it if feasible to reduce exposure.