CVE-2024-8552 is a missing authorization vulnerability (CWE-862) in the Download Monitor WordPress plugin by wpchill. The enable_shop() function lacks a capability check, permitting authenticated users with low-level privileges (Subscriber and above) to activate shop features improperly. This vulnerability affects all versions up to and including 5.0.9. The CVSS 3.1 base score is 4.3, reflecting a network attack vector, low complexity, required privileges at the low level, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and no availability impact.

An attacker with Subscriber-level access or higher can enable shop functionality without authorization. This unauthorized modification could lead to unintended activation of shop features, potentially affecting site behavior or business logic. There is no direct impact on confidentiality or availability reported. No known exploits are currently observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix links are provided, users should monitor wpchill's official channels for updates. In the meantime, restrict Subscriber-level access where possible and review user roles to minimize risk.