CVE-2024-7424 is an improper access control vulnerability (CWE-284) in the themeisle Multiple Page Generator Plugin – MPG for WordPress. The issue arises from missing capability checks on several functions, allowing authenticated users with low privileges (Subscriber-level and above) to invoke administrative functions. This enables unauthorized uploading of CSV files and viewing of MPG project data. The vulnerability affects all plugin versions up to and including 4.0.1. The CVSS 3.1 base score is 5.4, reflecting a medium severity with network attack vector, low attack complexity, and privileges required at the level of an authenticated user.

An attacker with Subscriber-level access or higher can bypass intended access controls to upload CSV files and view project data within the Multiple Page Generator Plugin. This could lead to unauthorized data exposure and modification within the plugin's scope. There is no indication of impact on system availability or higher privilege escalation beyond the plugin context. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Subscriber-level access to trusted users only and consider disabling or removing the plugin if Subscriber-level users do not require it. Monitor for updates from themeisle regarding a security patch or official fix.