CVE-2024-3627 is a missing authorization vulnerability (CWE-862) in the Wheel of Life: Coaching and Assessment Tool for Life Coach WordPress plugin. The issue arises from a lack of proper capability checks on several functions within the AjaxFunctions.php file in all versions up to and including 1.1.7. This allows authenticated users with subscriber-level privileges or higher to perform unauthorized actions such as deleting arbitrary posts and modifying plugin settings. The vulnerability affects integrity and availability but does not disclose sensitive information. No patch or official fix has been documented as of the publication date.

Exploitation of this vulnerability allows authenticated users with low privileges (subscriber-level and above) to delete arbitrary posts and alter plugin settings, potentially leading to data loss and disruption of service functionality. There is no indication of confidentiality impact. The medium CVSS score (5.4) reflects the moderate risk posed by unauthorized modification and availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles to trusted individuals only and consider disabling or removing the plugin if possible to prevent exploitation. Monitor for updates from the vendor or security advisories for an official patch or temporary workaround.