CVE-2024-5309 is a missing authorization vulnerability (CWE-862) in the Form Vibes – Database Manager for Forms WordPress plugin. The issue arises from the absence of capability checks on several functions including fv_export_csv, reset_settings, save_settings, save_columns_settings, get_analytics_data, get_event_logs_data, delete_submissions, and get_submissions. This allows authenticated users with low privileges (Subscriber-level and above) to access and modify data without proper authorization. The vulnerability affects all versions up to and including 1.4.12, with a partial fix applied in 1.4.12. No full patch or remediation details are provided in the available data.

An attacker with authenticated access at Subscriber level or higher can perform unauthorized data access and modification actions within the plugin, potentially leading to data exposure and unauthorized changes to form submissions and settings. The impact is limited to confidentiality and integrity with no availability impact reported. The medium CVSS score (5.4) reflects these moderate risks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Version 1.4.12 includes a partial fix, but users should verify if a complete fix has been released. Until a full patch is available, restrict user roles and privileges to trusted users only to minimize risk. Monitor vendor communications for updates on a complete remediation.