CVE-2024-6579 is a vulnerability classified under CWE-862 (Missing Authorization) found in the Web and WooCommerce Addons for WPBakery Builder plugin for WordPress. The issue arises because the plugin fails to perform proper capability checks on several of its functions, allowing authenticated users with low-level privileges (Subscriber role or above) to modify plugin settings that should be restricted. This vulnerability affects all versions up to and including 1.4.5. The lack of authorization checks means that an attacker who has gained even minimal access to a WordPress site can escalate their influence by altering plugin configurations, potentially impacting site behavior or security posture. The CVSS v3.1 score is 4.3 (medium severity), reflecting that the attack vector is network-based, requires low privileges, no user interaction, and impacts integrity but not confidentiality or availability. No patches or exploit code are currently publicly available, and no active exploitation has been reported. The vulnerability is particularly concerning for sites using this plugin in e-commerce contexts where configuration integrity is crucial.

The primary impact of CVE-2024-6579 is on the integrity of the affected WordPress sites. Unauthorized modification of plugin settings can lead to misconfiguration, degraded site functionality, or potentially enable further attacks if security-related settings are altered. While confidentiality and availability are not directly impacted, the integrity compromise can undermine trust in the site and disrupt business operations, especially for e-commerce sites relying on WooCommerce. Attackers with Subscriber-level access are typically limited, but this vulnerability lowers the barrier to privilege escalation or persistent manipulation of site behavior. Organizations with multiple users or weak access controls are at higher risk. The absence of known exploits reduces immediate threat but does not eliminate the risk of future attacks once exploit code is developed.

1. Immediately restrict user roles and permissions to the minimum necessary, especially limiting Subscriber-level users from accessing administrative areas. 2. Monitor and audit changes to plugin settings regularly to detect unauthorized modifications. 3. Apply security hardening measures on WordPress installations, including two-factor authentication and strong password policies to reduce the likelihood of unauthorized access. 4. Stay alert for official patches or updates from the plugin vendor and apply them promptly once released. 5. Consider temporarily disabling or replacing the affected plugin if critical until a fix is available. 6. Use Web Application Firewalls (WAFs) to monitor and block suspicious requests targeting plugin endpoints. 7. Educate site administrators and users about the risks of privilege misuse and enforce strict access controls.