CVE-2024-4566 is a missing authorization vulnerability (CWE-862) in the ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin for WordPress, affecting all versions up to 2.8.8. The ajax_dismiss function lacks proper capability checks, allowing authenticated attackers with contributor-level or higher privileges to set arbitrary WordPress options to "true". Additionally, attackers with lower privileges (subscriber or customer) can exploit this if WooCommerce is disabled or if authenticated users have admin dashboard access. This vulnerability enables unauthorized modification of WordPress options, which may lead to denial of service or other impacts related to site configuration.

Exploitation allows authenticated users with contributor or higher privileges to modify arbitrary WordPress options without proper authorization, potentially disrupting site functionality or availability. Users with lower privileges (subscriber or customer) can also exploit this under specific conditions (WooCommerce deactivated or admin dashboard access enabled). There is no indication of direct data confidentiality impact, but integrity and availability impacts are present. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles to trusted individuals only and avoid deactivating WooCommerce if possible. Also, limit access to the WordPress admin dashboard for authenticated users to reduce exposure. Monitor vendor channels for updates and apply patches promptly once released.