CVE-2024-50500 is a medium severity (CVSS 4.3) missing authorization flaw in the WordPress plugin Shortcodes and extra features for Phlox theme (auxin-elements), versions up to and including 2.17.4. A low privilege account is enough to use it. Patchstack says the fix is version 2.17.5, so update the plugin and review user accounts.
What's affected
The record names the plugin Shortcodes and extra features for Phlox theme, from n/a through 2.17.4. Patchstack confirms the vulnerable versions as 2.17.4 and earlier, and the patched version as 2.17.5.
Patchstack lists the required privilege as Subscriber, which means the attacker needs an account on the site, even a low privilege one. Sites that allow public registration are therefore more exposed than sites with a closed user list.
Patchstack rates the priority as low, with no impactful threat expected. That does not remove the need to update.
How to check if you're exposed
Read the plugin version from WordPress.
wp plugin list --fields=name,status,version | grep -i auxin
If the version is 2.17.4 or earlier, update. Also check whether your site allows open registration and how many subscriber accounts exist, since these are the accounts that could use the flaw.
What to do now
- Update the plugin to 2.17.5 or later.
- Review registered users and delete subscriber accounts that are spam or unused.
- Turn off open registration if you do not need it.
- Enable automatic updates for plugins that you trust and use.
- Check other Phlox related plugins and the theme for updates at the same time.
Why it matters
The weakness is CWE-862 (Missing Authorization). A function runs without checking whether the logged in user is allowed to do it. The code assumes that being logged in is enough, or that nobody will call it directly.
Broken access control sits at the top of the OWASP Top 10 for a reason: it is easy to write and easy to miss in review, because the feature works for the intended users. The score is low here, since the effect is limited, and the record does not flag exploitation. It is not on the KEV list. Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan that you can use to check manifests for known CVEs, and the Gold directory lists this one at https://gold.safeguard.sh/vulnerability/CVE-2024-50500.
Quick check
Which version fixes CVE-2024-50500?
Patchstack says 2.17.5.
Do attackers need an account?
Patchstack lists the required privilege as Subscriber, so yes, a low privilege account is enough.
Sources
Last reviewed: 19 October 2026.
