CVE-2024-5637 is a missing authorization vulnerability in the Market Exporter WordPress plugin by vanyukov. The issue arises from the lack of a capability check on the 'remove_files' function, enabling authenticated users with minimal privileges (Subscriber-level and above) to delete arbitrary files on the server via path traversal. This vulnerability affects all versions up to and including 2.0.19. The CVSS 3.1 base score is 7.5, indicating high severity due to the potential for denial of service or disruption of availability. No patch or official fix has been documented in the provided data.

Exploitation of this vulnerability allows an authenticated attacker with Subscriber-level access or higher to delete arbitrary files on the server hosting the WordPress site. This can lead to denial of service or disruption of the website's availability. There is no indication of confidentiality or integrity impact. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles to trusted individuals only and monitor for suspicious activity related to file deletion. Avoid granting Subscriber-level or higher access to untrusted users. Review and harden file permissions on the server to limit the impact of potential file deletions.