CVE-2024-32719

An unauthenticated attacker can exploit the missing authorization vulnerability by sending crafted HTTP requests to the WordPress site running WP Club Manager. Because the plugin fails to verify the user's capabilities before allowing access to certain resources or actions, any remote attacker with network access can trigger the unauthorized operation. The CVSS vector confirms the attack is network-based, requires no authentication, and no user interaction.

The WP Club Manager plugin (wp-club-manager) versions through 2.2.11 are affected. The vulnerability is a missing authorization check — the product does not perform an authorization check when an actor attempts to access a resource or perform an action.

The advisory does not include a published patch diff. The changelog for version 2.2.11 notes a security fix: "Permalink settings save now protected with a capability and nonce check" [ref_id=1], which suggests the fix adds proper capability checks and nonce verification to the affected endpoint. Without the full patch, the remediation guidance is to update to version 2.2.11 or later, which introduces authorization checks where they were previously missing.