CVE-2021-23227: 
WordPress vulnerability analysis and mitigation

A Cross-Site Request Forgery (CSRF) vulnerability was identified in the PHP Everywhere WordPress plugin versions 2.0.2 and below. The vulnerability was discovered and disclosed on December 23, 2021, and was assigned the identifier CVE-2021-23227. The affected software is Alexander Fuchs' PHP Everywhere plugin, a WordPress extension (Patchstack Database).

The vulnerability is classified as CWE-352 (Cross-Site Request Forgery). It received a CVSS score of 5.4, indicating a low severity impact. The technical nature of the vulnerability could allow malicious actors to force higher privileged users to execute unwanted actions under their current authentication (Patchstack Database).

The vulnerability could enable attackers to execute unauthorized actions on behalf of authenticated users. While classified as having a low severity impact, it falls under the OWASP Top 10 category A5: Broken Access Control (Patchstack Database).

The vulnerability was patched in version 2.0.3 of the PHP Everywhere plugin. Users are advised to update to version 2.0.3 or later to remove the vulnerability. Patchstack users have the additional option to enable auto-update for vulnerable plugins (Patchstack Database).