CVE-2024-5654 is a missing authorization vulnerability in the CF7 Google Sheets Connector WordPress plugin, affecting all versions up to 5.0.9. The vulnerability arises because the 'execute_post_data_cg7_free' function lacks a capability check, enabling unauthenticated users to toggle critical WordPress debug and query logging settings. This can lead to unauthorized modification of site configuration, potentially exposing sensitive information or affecting site behavior. The vulnerability has a CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, no privileges required, and no user interaction needed.

An unauthenticated attacker can modify WordPress site configuration settings related to debugging and query logging. This may lead to information disclosure through debug logs or altered site behavior, but does not directly impact availability. The confidentiality and integrity impacts are limited to the ability to change these settings, which could facilitate further attacks or information leakage.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the plugin and monitor for suspicious activity. Consider disabling or removing the plugin if it is not essential. Avoid exposing the WordPress admin or plugin endpoints to untrusted networks.