The WP Chill Htaccess File Editor plugin versions up to 1.0.18 suffer from an incorrect authorization vulnerability (CVE-2024-49256) that permits access to functionality without proper ACL enforcement. This could allow users with limited privileges to access or modify features they should not be authorized to use. The vulnerability is network exploitable with low attack complexity and requires low privileges but no user interaction. The impact includes limited integrity and availability effects but no confidentiality impact.

The vulnerability allows unauthorized access to certain plugin functionalities, which could lead to limited integrity and availability impacts within affected WordPress installations. There is no indication of confidentiality compromise. The medium CVSS score reflects the potential for misuse by low-privileged users over the network without user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the plugin to trusted users only and monitor for any unusual activity related to the Htaccess File Editor plugin. Avoid granting unnecessary privileges to users who do not require access to this plugin's functionality.