CVE-2024-7622 is a missing authorization vulnerability (CWE-862) in the Revision Manager TMC WordPress plugin. The issue arises from the lack of a capability check in the _a_ajaxQuickEmailTestCallback() function, enabling authenticated users with minimal privileges (subscriber-level and above) to send arbitrary emails via the vulnerable server. This could be exploited to send unauthorized emails with arbitrary content to any recipient. The vulnerability has a CVSS 3.1 base score of 4.3 (medium severity), reflecting low complexity and limited impact on confidentiality and availability.

An attacker with subscriber-level access or higher can exploit this vulnerability to send arbitrary emails through the affected WordPress server. This could be used for spam, phishing, or other malicious email campaigns originating from a trusted domain. There is no direct impact on confidentiality or availability reported. No known exploits in the wild have been documented at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber-level access to trusted users only and monitor for suspicious email activity originating from the server. Avoid granting unnecessary permissions to low-privilege users. Follow the vendor's updates for any forthcoming patches or official mitigations.