The vulnerability CVE-2026-24388 affects the WPMasterToolKit plugin by Ludwig You, where missing authorization checks due to misconfigured access control allow unauthorized users with limited privileges to perform actions that could alter system integrity. This affects all versions up to 2.14.0. The CVSS 3.1 vector indicates the attack can be performed remotely over the network with low complexity and requires low privileges but no user interaction. The impact is limited to integrity without confidentiality or availability effects.

Exploitation of this vulnerability can lead to unauthorized modification of data or settings within the affected plugin, potentially compromising the integrity of the system it is installed on. There is no impact on confidentiality or availability reported. No known active exploitation has been documented.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, restrict access to the plugin's administrative functions to trusted users only to minimize risk.