CVE-2020-9043: 
WordPress vulnerability analysis and mitigation

CVE-2020-9043 affects the wpCentral WordPress plugin versions below 1.5.1. The vulnerability was discovered by Chloe Chamberland from the Wordfence team and was publicly disclosed on February 17, 2020. The vulnerability affects WordPress installations with subscriber-level registration enabled and the vulnerable wpCentral plugin installed (Wordfence Blog).

The vulnerability is classified as an Improper Access Control leading to Privilege Escalation with a CVSS score of 8.8 (High). The flaw allows an attacker with subscriber-level access to escalate their privileges to those of an administrator by exploiting the connection key exposure and authentication mechanism (WPScan).

If successfully exploited, an attacker could gain administrative access to the WordPress site, potentially allowing them to modify site content, install malicious plugins, access sensitive information, and take complete control of the website (Wordfence Blog).

The vulnerability was patched in version 1.5.1 of the wpCentral plugin. Site administrators should update to this version immediately. As part of the security fix, the plugin developers cleaned unnecessary filters and hooks, prevented disclosure of the connection key, and reset wpCentral Auth Keys for all users as a security precaution (WPScan).