CVE-2024-3627

Name of the Vulnerable Software and Affected Versions The Wheel of Life: Coaching and Assessment Tool for Life Coach plugin for WordPress versions up to, and including, 1.1.7

Description The issue is related to a missing capability check on several functions in the AjaxFunctions.php file. This allows authenticated attackers with subscriber-level access and above to delete arbitrary posts and modify settings.

Recommendations For versions up to, and including, 1.1.7, update to a version that includes a capability check on the affected functions in the AjaxFunctions.php file to prevent unauthorized modification and data loss. As a temporary workaround, consider restricting access to the AjaxFunctions.php file or the affected functions to minimize the risk of exploitation.