CVE-2024-6012 is a missing authorization vulnerability (CWE-862) in the stylemix Cost Calculator Builder WordPress plugin. The plugin fails to enforce capability checks on the 'embed-create-page' and 'embed-insert-pages' functions, allowing authenticated users with Subscriber-level privileges or higher to create arbitrary posts and modify existing posts by appending content. This vulnerability affects all versions up to and including 3.2.12. The CVSS 3.1 base score is 4.3, reflecting a medium severity impact primarily on integrity. No patch or remediation details have been provided by the vendor or in the advisory.

An attacker with at least Subscriber-level access can create new posts or append arbitrary content to existing posts within a WordPress site using the vulnerable plugin. This could lead to unauthorized content injection or modification, potentially impacting site integrity. There is no indication of confidentiality or availability impact. No known exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles to limit Subscriber-level access where possible and monitor for unauthorized content changes related to the Cost Calculator Builder plugin. Avoid granting unnecessary privileges to authenticated users. Follow vendor updates for any forthcoming patches.