CVE-2022-2597: 
WordPress vulnerability analysis and mitigation

The Visual Portfolio, Photo Gallery & Post Grid WordPress plugin before version 2.19.0 contains a vulnerability identified as CVE-2022-2597. The vulnerability was discovered and publicly disclosed on August 15, 2022. This security issue affects the plugin's REST endpoints, where improper authorization checks allow users with contributor-level access to perform unauthorized actions (WPScan Advisory).

The vulnerability is classified as an Incorrect Authorization issue (CWE-863) and falls under the OWASP Top 10 category A5: Broken Access Control. It received a CVSS v3.1 base score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. The technical issue stems from insufficient authorization checks in the plugin's REST endpoints, specifically in the layout update functionality (NVD, WPScan Advisory).

The vulnerability allows users with contributor-level access to inject arbitrary CSS into saved layouts. This can potentially lead to visual manipulation of the website's appearance and could be used for malicious purposes such as defacement or interface manipulation (WPScan Advisory).

The vulnerability has been fixed in version 2.19.0 of the Visual Portfolio, Photo Gallery & Post Grid plugin. Users are advised to update to this version or later to mitigate the security risk (WPScan Advisory).