The vulnerability CVE-2024-5704 in the Happy WooCommerce FAQs – Ultimate Product FAQ Plugin arises from missing capability checks in multiple functions such as ffw_insert_new_faq, ffw_hide_discount_notice, ffw_delete_all_faqs, and ffw_delete_single_faq. This flaw permits authenticated users with low privileges (subscriber-level and above) to add, update, or delete FAQs and modify their associations with WooCommerce products. The issue affects all versions up to 1.7.0 and is classified under CWE-862 (Missing Authorization). The CVSS 3.1 base score is 4.3, reflecting a medium severity with network attack vector, low attack complexity, and no user interaction required.

Exploiting this vulnerability allows an attacker with subscriber-level access to modify FAQ content and product associations within the WooCommerce store. While it does not impact confidentiality or availability, it can lead to unauthorized information modification, potentially misleading customers or damaging the integrity of product information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber-level access where possible and monitor for unauthorized changes to FAQ content. Avoid granting unnecessary privileges to low-level authenticated users.