CVE-2024-9520 is a missing authorization vulnerability (CWE-862) in the UserPlus WordPress plugin for user registration and profile management. The issue affects all versions up to and including 2.0, where multiple functions do not enforce capability checks. This flaw permits authenticated users with subscriber-level permissions or above to perform unauthorized actions such as adding, modifying, or deleting user metadata and plugin options, potentially leading to data loss or unauthorized configuration changes. The vulnerability has a CVSS 3.1 base score of 6.3, indicating medium severity.

Authenticated users with subscriber-level permissions or higher can exploit this vulnerability to alter user meta information and plugin options without proper authorization. This can lead to unauthorized data modification and potential loss of data integrity within the affected WordPress site. The impact includes confidentiality, integrity, and availability losses rated as low to medium based on the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber-level user permissions where possible and monitor for unusual changes to user meta and plugin options. Avoid granting unnecessary permissions to authenticated users. Follow updates from the UserPlus plugin vendor for any forthcoming patches or official mitigations.