CVE-2024-50483

Deeper analysis

CVE-2024-50483 is an Authorization Bypass Through User-Controlled Key vulnerability, tracked as CWE-639, that affects the Meetup WordPress plugin by Tareq Hasan. The flaw impacts all versions from the initial release through 0.1 and carries a CVSS 3.1 score of 9.8, reflecting network-exploitable conditions with no required authentication or user interaction that can result in full confidentiality, integrity, and availability impacts.

An unauthenticated attacker can supply a crafted user-controlled key to bypass authorization checks, enabling privilege escalation within the WordPress instance. Because the plugin exposes this logic over the network without access controls, remote exploitation can grant administrative capabilities or other elevated rights depending on the targeted functionality.

The Patchstack advisory at the referenced URL identifies the broken authentication issue in the Meetup plugin and provides the canonical vulnerability record for remediation tracking.

EPSS values reached a peak of 0.6562 with a current score of 0.5397, indicating a material rise in predicted exploitation likelihood after disclosure that warrants renewed attention from defenders.