CVE-2024-6799 is a missing authorization vulnerability (CWE-862) in the YITH Essential Kit for WooCommerce #1 plugin for WordPress. The flaw exists because the functions 'activate_module', 'deactivate_module', and 'install_module' lack proper capability checks. This allows authenticated users with low privileges (Subscriber-level and above) to modify the activation state of certain YITH plugins. The vulnerability affects all versions up to and including 2.34.0. The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low privileges required and no user interaction needed, impacting integrity but not confidentiality or availability.

An attacker with Subscriber-level access can install, activate, or deactivate plugins from a predefined list of YITH plugins without proper authorization. This unauthorized modification can lead to integrity issues within the WordPress environment, potentially enabling further malicious activity or disruption of site functionality. There is no direct impact on confidentiality or availability reported. No known exploits have been observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Subscriber-level access and review user roles carefully to limit exposure. Monitor for updates from the vendor yithemes regarding patches or official mitigations.