CVE-2024-7258 is a missing authorization vulnerability (CWE-862) in the WooCommerce Google Feed Manager plugin for WordPress (aukejomm WPMR) versions up to 2.8.0. The vulnerability arises from the lack of a capability check on the 'wppfm_removeFeedFile' function, enabling authenticated users with Contributor-level privileges or higher to delete arbitrary server files. This unauthorized file deletion can escalate to remote code execution if critical files such as wp-config.php are targeted. The CVSS 3.1 base score is 8.8, reflecting network attack vector, low attack complexity, privileges required at the contributor level, no user interaction, and high impact on confidentiality, integrity, and availability.

An attacker with Contributor-level or higher access can delete arbitrary files on the server hosting the vulnerable plugin. This can result in loss of critical configuration files, potentially leading to remote code execution and full system compromise. The impact affects confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level access to trusted users only and monitor for suspicious file deletion activity related to the plugin. Avoid granting unnecessary privileges to users and consider disabling or removing the plugin if not essential.