CVE-2024-31284

The EmbedPress plugin for WordPress before version 3.9.9 contains a broken access control vulnerability discovered by Majed Refaea. The flaw stems from missing authorization, authentication, or nonce verification in a function, allowing unauthenticated or low-privilege users to perform actions that should require higher permissions. The issue was resolved in version 3.9.9, and users should upgrade to this version or later to address the vulnerability.

Based on public CVE data (MITRE/NVD).