The vulnerability identified as CVE-2024-4355 involves a missing capability check (CWE-862) in the stopbadbots_get_ajax_data() function of the 'Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection' WordPress plugin. This flaw permits authenticated users with low-level privileges (subscriber and above) to retrieve visitor data that should otherwise be restricted. The vulnerability is present in all plugin versions up to 10.23. The CVSS v3.1 base score is 4.3, reflecting a network attack vector, low attack complexity, requiring privileges, no user interaction, and limited confidentiality impact without integrity or availability impact.

An attacker with subscriber-level access or higher can exploit this vulnerability to access visitor data that should be protected. The confidentiality impact is limited, as only visitor data exposure is noted, with no integrity or availability impacts. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber-level access to trusted users only. Monitor for updates from the plugin vendor or WordPress plugin repository to apply any forthcoming patches promptly.