This vulnerability (CVE-2024-39640) in QuadLayers WP Social Feed Gallery arises from missing authorization controls, classified under CWE-862. It affects versions up to 4.3.9 and allows unauthorized users to perform actions that should require proper access permissions. The CVSS 3.1 base score is 6.5, with network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, low integrity impact, and low availability impact. No patch or official remediation level has been disclosed by the vendor, and no exploits are currently known.

The vulnerability could allow attackers without privileges to perform unauthorized actions that may alter data integrity and availability within the WP Social Feed Gallery plugin. There is no impact on confidentiality. The medium CVSS score reflects the potential for limited but meaningful disruption or modification of plugin functionality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary workaround has been published, users should monitor vendor communications for updates. Until a patch is available, consider restricting access to the plugin's administrative interfaces and applying principle of least privilege to users managing the plugin.