CVE-2024-4661 is a missing authorization vulnerability (CWE-862) in the WP Reset WordPress plugin affecting all versions up to and including 2.02. The issue arises from the absence of a capability check in the save_ajax function, enabling authenticated users with subscriber-level privileges or above to alter the 'License Key' value for the 'Activate Pro License' setting. This could lead to unauthorized modification of plugin configuration data. The vulnerability has a CVSS 3.1 base score of 4.3, indicating medium severity. No patch or official fix has been documented as of the published date.

An attacker with subscriber-level access or higher can modify the license key setting of the WP Reset plugin without proper authorization. This unauthorized modification could potentially affect plugin licensing behavior but does not directly impact confidentiality or availability. There are no reports of exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber-level user permissions where possible and monitor for unauthorized changes to plugin settings. Avoid granting unnecessary privileges to low-level authenticated users.