The vulnerability identified as CVE-2024-44021 affects Truepush plugin versions up to 1.0.8. It is a missing authorization issue, meaning certain operations can be performed without verifying the user's permissions. The CVSS 3.1 base score is 5.4 (medium), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, limited confidentiality impact, no integrity impact, and low availability impact. No patch or official fix information is provided, and the product is not a cloud service.

An attacker with low privileges can exploit the missing authorization to perform unauthorized actions, resulting in limited confidentiality loss and minor availability degradation. There is no indication of integrity compromise or widespread exploitation at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the Truepush plugin to trusted users only and monitor for unusual activity related to authorization bypass attempts.