CVE-2024-6987 is a missing authorization vulnerability (CWE-862) in the Orchid Store WordPress theme by themebeez. The issue arises because the 'orchid_store_activate_plugin' function lacks a capability check, permitting authenticated users with Subscriber-level privileges or above to activate the Addonify Floating Cart For WooCommerce plugin without proper authorization. This could lead to unauthorized modification of plugin activation status. The vulnerability affects all versions up to and including 1.5.6. The CVSS 3.1 base score is 4.3 (medium), reflecting low complexity and limited impact on integrity only. No patch or vendor advisory is currently available.

An attacker with at least Subscriber-level access can activate a specific WooCommerce plugin without proper authorization. This unauthorized modification could potentially alter site behavior or functionality by enabling the Addonify Floating Cart plugin. There is no impact on confidentiality or availability reported. No known exploits have been observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles to trusted individuals only and monitor for unauthorized plugin activations. Avoid granting Subscriber or higher privileges to untrusted users. Review installed plugins and disable or remove the Addonify Floating Cart For WooCommerce plugin if it is not needed.