CVE-2024-6167 describes a missing authorization vulnerability in the Just Custom Fields WordPress plugin by aprokopenko. The issue arises because several AJAX functions lack proper capability checks, allowing authenticated users with Subscriber privileges or higher to invoke administrative functionality. This can lead to unauthorized management of field groups and visibility settings. The vulnerability affects all versions up to and including 3.3.2. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and no availability impact.

Authenticated users with Subscriber-level access or higher can exploit this vulnerability to perform administrative actions within the plugin, such as managing field groups and altering visibility of items. This could lead to unauthorized changes in the WordPress site's custom field configurations, potentially impacting site behavior or content presentation. There is no direct confidentiality or availability impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles to minimize exposure and monitor for suspicious activity related to Just Custom Fields plugin functionality. Avoid granting Subscriber or higher privileges to untrusted users. Follow vendor communications for updates on patches or official fixes.