This vulnerability (CVE-2024-33910) in Digital Publications by Supsystic is classified as CWE-862 (Missing Authorization). It affects versions up to 1.7.7 and allows unauthorized network attackers to gain limited read access to data or functionality without authentication or privileges. The CVSS 3.1 vector indicates the attack is network-based, requires no privileges or user interaction, and impacts confidentiality only. No official fix or mitigation has been published by the vendor, and the product is not a cloud service.

The vulnerability permits unauthorized access to certain data or features within the affected plugin, potentially exposing confidential information. There is no impact on data integrity or availability. The medium severity reflects the limited scope of confidentiality loss and the ease of exploitation due to no required privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the plugin's functionality through other means such as web application firewalls or limiting user roles. Monitor vendor channels for updates and apply patches promptly once available.