CVE-2024-6599 describes a missing authorization vulnerability in the Meks Video Importer WordPress plugin (versions up to 1.0.12). The ajax_save_settings function lacks proper capability checks, enabling authenticated users with low privileges (Subscriber or above) to modify the plugin's API keys. This could potentially lead to unauthorized changes affecting plugin behavior or integration. The vulnerability is classified under CWE-862. No patch or remediation details are provided in the vendor or CVE data.

An attacker with authenticated Subscriber-level access or higher can modify the plugin's API keys without authorization. This unauthorized modification could impact the plugin's integration with external services relying on those keys, potentially disrupting functionality or enabling further misuse. The vulnerability does not directly impact confidentiality or availability according to the CVSS vector, but integrity is affected at a low level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles to trusted individuals only and monitor for unauthorized changes to plugin settings. Avoid granting Subscriber-level or higher access to untrusted users. Follow updates from the plugin vendor for any forthcoming patches or official mitigations.