CVE-2024-3607 is a missing authorization vulnerability (CWE-862) in the PropertyHive WordPress plugin affecting all versions up to 2.0.12. The delete_key_date() function lacks a capability check, permitting authenticated users with low-level privileges (subscriber and above) to delete arbitrary posts. This vulnerability impacts availability by enabling unauthorized content deletion. The CVSS 3.1 base score is 4.3, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and no impact on confidentiality or integrity. No patch or official remediation level is currently documented.

The vulnerability allows authenticated users with subscriber-level access or higher to delete arbitrary posts, resulting in potential loss of availability of content on affected WordPress sites using PropertyHive plugin versions up to 2.0.12. There is no impact on confidentiality or integrity. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber-level user permissions where possible and monitor for suspicious deletion activity. Avoid granting unnecessary privileges to low-level authenticated users.