CVE-2024-5648 is a missing authorization vulnerability (CWE-862) in the LearnDash LMS – Reports plugin for WordPress. The flaw arises because several functions (including wrld_set_configuration, wrld_exclude_settings_save, apply_time_tracking_settings, and wp_ajax_wrld_gutenberg_block_visit) do not perform proper capability checks. This allows authenticated users with subscriber-level privileges or higher to update various plugin settings unauthorized. The vulnerability affects all versions up to and including 1.8.2.1. The CVSS 3.1 base score is 5.4, reflecting a medium severity with network attack vector, low attack complexity, and privileges required at the low level.

An attacker with subscriber-level access or higher can modify plugin settings without authorization, potentially impacting the integrity and availability of the LearnDash LMS – Reports plugin's configuration. There is no indication of confidentiality impact. The vulnerability could lead to unauthorized changes that may disrupt normal plugin operations or cause denial of service conditions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles and permissions to trusted users only, limiting subscriber-level access where possible. Monitor plugin updates from the vendor for a security patch addressing this issue.