CVE-2024-5677 is a missing authorization vulnerability (CWE-862) in the Featured Image Generator plugin for WordPress, affecting all versions up to and including 1.3.1. The vulnerability arises because the fig_save_after_generate_image function does not perform proper capability checks, enabling authenticated users with Subscriber-level privileges or higher to upload arbitrary images to galleries associated with posts. This could lead to unauthorized content injection within the WordPress site. The CVSS 3.1 base score is 4.3 (medium), with attack vector network, low attack complexity, privileges required at the low level, no user interaction, unchanged scope, no confidentiality or availability impact, and limited integrity impact.

The vulnerability allows authenticated users with minimal privileges (Subscriber-level) to upload arbitrary images to post galleries, potentially enabling unauthorized content insertion or defacement. There is no direct impact on confidentiality or availability. The integrity of post-related galleries can be affected due to unauthorized image uploads. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's announcements for updates. In the meantime, restrict plugin usage to trusted users and consider disabling or removing the Featured Image Generator plugin if Subscriber-level users do not require image upload capabilities.