CVE-2024-9586 affects the Linkz.ai – Automatic link previews on hover WordPress plugin by vittor1o. The vulnerability arises from missing capability checks in the 'check_auth' and 'check_logout' functions, which allows unauthenticated attackers to update plugin settings. This represents a missing authorization control (CWE-862) that could lead to unauthorized configuration changes. The vulnerability is present in versions up to and including 1.1.8. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, low integrity impact, and low availability impact.

An unauthenticated attacker can modify the plugin's settings, potentially altering its behavior or configuration. While confidentiality is not impacted, integrity and availability impacts are rated low, meaning the attacker could cause some disruption or unauthorized changes but not full system compromise. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should consider disabling or removing the vulnerable plugin to prevent unauthorized modifications. Monitoring for unusual changes in plugin settings is advisable. Avoid granting unnecessary permissions to untrusted users. Follow updates from the vendor or WordPress plugin repository for any forthcoming patches.