CVE-2024-6591 describes a missing authorization vulnerability in the Ultimate WordPress Auction Plugin by nitesh_singh. Specifically, the 'send_auction_email_callback' and 'resend_auction_email_callback' functions lack proper capability checks, enabling unauthenticated users to send crafted emails with arbitrary links to any recipient. This vulnerability affects all versions up to and including 4.2.7. The CVSS 3.1 base score is 5.8, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, scope change, no confidentiality impact, limited integrity impact, and no availability impact.

An attacker can exploit this vulnerability to send unauthorized emails that may include malicious links, potentially facilitating phishing or social engineering attacks. There is no direct confidentiality or availability impact reported. The integrity impact is limited to the ability to send unauthorized emails, which could undermine trust in communications originating from the affected plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider disabling or restricting access to the affected email sending functions if possible. Monitoring for unusual email activity related to the plugin is advisable. Avoid relying on this plugin for critical email communications until the vulnerability is addressed.