CVE-2024-3520 is a missing authorization vulnerability (CWE-862) in the Country State City Dropdown CF7 WordPress plugin by trustyplugins. The issue arises from the absence of a capability check in the tc_csca_patch_settings function, allowing authenticated users with subscriber privileges or above to add unauthorized entries to the dropdown lists of states or cities. This vulnerability affects all plugin versions up to and including 2.7.1. The CVSS 3.1 base score is 4.3 (medium), reflecting low complexity and limited impact confined to integrity modification without confidentiality or availability impact. There is no indication of known exploits in the wild or an official patch at this time.

Authenticated users with subscriber-level access or higher can modify the plugin's dropdown data by adding states or cities, potentially leading to unauthorized data changes. There is no impact on confidentiality or availability. The integrity of the dropdown data is compromised, which could affect application behavior relying on this data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles to minimize exposure and monitor for unauthorized changes to dropdown data. Avoid granting subscriber or higher privileges to untrusted users. Follow updates from trustyplugins for patch availability.