CVE-2024-4088 identifies a missing authorization vulnerability (CWE-862) in the Gutenberg Blocks and Page Layouts – Attire Blocks WordPress plugin. The disable_fe_assets function lacks capability checks, enabling authenticated users with minimal privileges (subscriber or above) to alter plugin settings. Furthermore, the plugin does not implement nonce verification, leading to a CSRF vulnerability. This combination allows unauthorized modification of plugin data without user interaction requirements beyond authentication. The vulnerability affects all versions up to and including 1.9.2.

The vulnerability allows authenticated users with subscriber or higher privileges to modify plugin settings without proper authorization, impacting the integrity of the plugin's configuration. There is no impact on confidentiality or availability. The lack of nonce checks also exposes the plugin to CSRF attacks, potentially enabling attackers to perform unauthorized actions via forged requests.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, restrict user roles to trusted users only and monitor for suspicious activity related to plugin settings changes. Avoid granting subscriber or higher privileges to untrusted users. Implement manual nonce checks or other CSRF protections if possible.