The vulnerability identified as CVE-2026-24382 affects the wproyal News Magazine X plugin (version <= 1.2.50). It is characterized by missing authorization controls, resulting from incorrectly configured access control security levels. This allows an attacker to access functionality or data without proper permissions. The CVSS 3.1 base score is 7.5, reflecting high impact on confidentiality with no impact on integrity or availability. The vulnerability is remotely exploitable without authentication or user interaction. No patch or vendor advisory is provided, and the product is not a cloud service.

Successful exploitation of this vulnerability could lead to unauthorized disclosure of sensitive information due to missing authorization checks. The CVSS vector indicates high confidentiality impact but no impact on integrity or availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix is currently available, users should monitor for updates from the vendor or trusted security sources. Until a fix is released, consider restricting access to the affected plugin or disabling it if feasible.