CVE-2024-5857 is a vulnerability classified under CWE-862 (Missing Authorization) found in the Funnelforms Free WordPress plugin, which provides an Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor functionality. The vulnerability exists because the plugin fails to perform a capability check on the af2_handel_file_remove AJAX action. This omission allows unauthenticated attackers to invoke this AJAX endpoint and delete arbitrary media files stored on the WordPress site. Since the vulnerability affects all versions up to and including 3.7.3.2, any site running these versions is susceptible. The attack vector is remote and requires no privileges or user interaction, making exploitation straightforward. The impact is primarily on availability, as attackers can remove media assets, potentially disrupting website operations, content presentation, and user experience. Although no public exploits have been reported yet, the vulnerability's nature and ease of exploitation make it a significant risk for affected sites. The vulnerability was published on August 29, 2024, with a CVSS v3.1 score of 5.3, indicating a medium severity level.

The primary impact of CVE-2024-5857 is the unauthorized deletion of media files, which can lead to partial or complete denial of service for affected WordPress sites using the Funnelforms Free plugin. This can disrupt website functionality, degrade user experience, and potentially cause loss of critical media content such as images, documents, or videos. For organizations relying heavily on their WordPress sites for customer interaction, marketing, or e-commerce, this could result in reputational damage and operational downtime. Since the vulnerability allows unauthenticated remote attackers to delete files, it increases the attack surface significantly. Although it does not directly compromise confidentiality or integrity of data beyond file deletion, the availability impact alone can be costly. Additionally, attackers could leverage this vulnerability as part of a broader attack chain to weaken site defenses or prepare for further exploitation.

To mitigate CVE-2024-5857, organizations should immediately update the Funnelforms Free plugin to a version where this vulnerability is patched once available. In the absence of an official patch, administrators can implement the following measures: 1) Restrict access to the AJAX endpoint af2_handel_file_remove by configuring web application firewalls (WAFs) or server rules to block unauthenticated requests targeting this action. 2) Employ strict file permission controls on the media upload directories to limit deletion capabilities. 3) Monitor server logs for suspicious AJAX requests that invoke file deletion actions and respond promptly to anomalies. 4) Consider temporarily disabling the plugin if it is not critical to site operations until a patch is released. 5) Regularly back up media files and site content to enable rapid recovery in case of deletion. 6) Implement least privilege principles for all plugins and user roles to minimize potential damage from exploitation.