More severe of the two is CVE-2024-10542, which evades authorization for the plugin's remote call and plugin installation function, according to a report from Defiant.
Article Link: Widespread WordPress compromise possible with critical plugin flaws | SC Media