The vulnerability identified as CVE-2024-49680 involves missing authorization checks in the RexTheme WP VR WordPress plugin (versions up to 8.5.5). This improper access control configuration permits users with limited privileges to perform actions they should not be authorized to execute. The issue is categorized as a medium severity vulnerability with a CVSS 3.1 base score of 4.3, indicating a network attack vector with low complexity and no user interaction required. No patch or remediation details have been provided by the vendor at this time.

Exploitation of this vulnerability could allow an attacker with some level of access to the WordPress environment to perform unauthorized actions due to missing authorization controls. The impact is limited to integrity as per the CVSS vector, with no confidentiality or availability impact reported. There are no known active exploits in the wild, reducing immediate risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, review and tighten access control configurations for the WP VR plugin and restrict user privileges to the minimum necessary. Monitor for vendor updates regarding patches or official mitigations.