The vulnerability identified as CVE-2024-8513 in the quarka QA Assistants – Driven by data WordPress plugin is due to a missing capability check in the ajax_save_plugin_config() function. This lack of authorization verification enables unauthenticated attackers to update the plugin's settings, potentially altering its behavior. The issue affects all versions up to 4.1.1.1. The CVSS 3.1 base score is 5.3 (medium), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality or availability impact, but low impact on integrity. No patch or vendor advisory is currently provided, and the plugin is not a cloud service, so remediation depends on vendor updates.

An unauthenticated attacker can modify the plugin's configuration settings without authorization. This could lead to altered plugin behavior or data integrity issues within the plugin's operation. There is no direct impact on confidentiality or availability reported. No known exploits are currently observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the WordPress admin and consider disabling or removing the vulnerable plugin if possible. Monitor for updates from the vendor and apply patches promptly once available.