The vulnerability CVE-2024-56048 in VibeThemes WPLMS plugin versions up to 1.9.9 is due to missing authorization checks, enabling users with some privileges to access restricted functionality improperly. This lack of proper ACL enforcement can lead to unauthorized actions affecting the confidentiality, integrity, and availability of the system. The CVSS 3.1 base score of 8.8 reflects network attack vector, low attack complexity, required privileges, no user interaction, and high impact on all security objectives. No vendor patch or advisory is currently provided, and the product is not a cloud service.

Successful exploitation could allow an attacker with limited privileges to perform unauthorized actions within the WPLMS plugin, potentially leading to full compromise of the affected system's confidentiality, integrity, and availability. This could result in unauthorized data access, modification, or disruption of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the WPLMS plugin to trusted users only and monitor for suspicious activity related to privilege misuse. Avoid granting unnecessary privileges to users within the system.