The vulnerability identified as CVE-2024-54278 affects the News Ticker for Elementor plugin by Plugin Devs. It is characterized by missing authorization controls, enabling users with low privileges to perform actions or access features that should be protected by ACLs. The affected versions include all releases up to 2.1.3. The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low attack complexity, requiring privileges but no user interaction, and resulting in integrity impact only. There is no indication of confidentiality or availability impact. No patch or official fix has been documented in the provided data.

The vulnerability allows unauthorized access to certain plugin functionalities that are not properly constrained by access controls. This can lead to integrity issues within the affected system but does not compromise confidentiality or availability. Since the attack complexity is low and privileges are required, an attacker with some level of access could exploit this to perform unauthorized actions within the plugin's scope.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user privileges to the minimum necessary and monitor for unusual activity related to the plugin. Avoid granting unnecessary permissions to users who can interact with the News Ticker for Elementor plugin.