The vulnerability identified as CVE-2024-38690 in the Avirtum iPanorama 360 WordPress Virtual Tour Builder plugin is classified as CWE-862 (Missing Authorization). It allows unauthorized access to certain plugin functions that are not properly constrained by ACLs. This issue affects all versions up to 1.8.3. The CVSS v3.1 base score is 5.3 (medium), with attack vector network, low attack complexity, no privileges required, no user interaction, and limited confidentiality impact. No official patch or vendor advisory detailing remediation is currently available.

An attacker can access functionality within the plugin that should be restricted, potentially leading to unauthorized information disclosure or other unintended behavior limited to confidentiality impact. There is no indication of integrity or availability impact. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor for updates from Avirtum and consider limiting exposure of the affected plugin or disabling it if feasible to reduce risk.