CVE-2024-35749 describes an authentication bypass by spoofing vulnerability in the Acurax Under Construction / Maintenance Mode plugin for WordPress, affecting versions through 2.6. This vulnerability allows an attacker to bypass authentication controls, potentially gaining unauthorized access to restricted functionality or content. The CVSS 3.1 base score is 3.7 (low), reflecting network attack vector, high attack complexity, no privileges required, no user interaction, and limited confidentiality impact. No vendor advisory or patch is currently available, and no known exploits have been reported.

The vulnerability allows an attacker to bypass authentication mechanisms by spoofing, which could lead to unauthorized access to the plugin's restricted areas or features. The impact is limited to confidentiality with no reported integrity or availability effects. Given the low CVSS score and lack of known exploits, the immediate risk is considered low.

No official patch or remediation guidance is currently available from the vendor. Users should monitor the vendor's communications for updates or patches addressing this vulnerability. Until a fix is released, consider limiting exposure of the affected plugin or disabling it if feasible to reduce risk.