CVE-2024-1677 is a medium severity (CVSS 6.3) missing authorization flaw in the Print Labels with Barcodes plugin for WordPress, in all versions up to and including 3.4.6. Authenticated users with subscriber access or higher can control the plugin through 42 AJAX functions. Update to a newer release.
What's affected
The record says all versions up to and including 3.4.6 of the plugin by UkrSolution are affected. It describes an improper capability check on 42 separate AJAX functions, which lets authenticated attackers with subscriber access and above change plugin settings and profiles and more. The references are a WordPress plugin changeset and a Wordfence entry. We did not fetch them, so confirm the first fixed version on the plugin page.
The score is 6.3 (medium) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. The weaknesses are CWE-862 (missing authorization) and CWE-863 (incorrect authorization).
How to check if you're exposed
List installed plugins and versions with WP-CLI.
wp plugin list --fields=name,version,status | grep -i barcode
The plugin directory name in the record's references is a4-barcode-generator. If it reports 3.4.6 or lower, you are affected. Also look at who has accounts on the site, because a subscriber account is enough. Open registration widens the exposure.
What to do now
- Update the plugin to a version newer than 3.4.6 from the WordPress plugin directory.
- Review user accounts and remove subscribers you do not recognize.
- If you do not need open registration, turn it off.
- If you cannot update, deactivate the plugin until you can.
- Check plugin settings and label profiles for unexpected changes.
Why it matters
WordPress plugins register AJAX actions that run for any logged in user unless the code checks capabilities. When a developer forgets those checks, a subscriber, the lowest normal role, can do what an administrator should do. The result is both CWE-862 (missing authorization) and incorrect authorization.
The score is medium because the attacker needs an account, but many shops allow customer registration, which makes an account cheap to get. Not listed as exploited. Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan can show whether a component tied to this CVE appears in your dependency manifests. The Gold directory keeps the record, severity and references in one place, and reachability analysis helps you separate code paths that can actually be hit from packages that are merely installed.
Quick check
Does the attacker need a login?
Yes. The record says authenticated attackers with subscriber access and above.
Sources
Last reviewed: 19 October 2026.
