CVE-2024-3936 is a missing authorization vulnerability (CWE-862) in the The Post Grid plugin for WordPress, specifically in the rtTPGSaveSettings function. The lack of a capability check allows authenticated users with low privileges (subscriber or higher) to change plugin settings and invoke other AJAX actions improperly. This affects all versions up to and including 7.6.1. The vulnerability is remotely exploitable over the network without user interaction and does not impact confidentiality or availability but allows unauthorized modification of plugin settings.

An attacker with subscriber-level access or higher can modify the plugin's settings and invoke other AJAX functions, potentially altering site behavior or configuration without proper authorization. There is no indication of confidentiality or availability impact. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles to trusted individuals and monitor for unauthorized changes to plugin settings. Avoid granting subscriber or higher privileges to untrusted users.