CVE-2022-38058: 
WordPress vulnerability analysis and mitigation

The vulnerability (CVE-2022-38058) affects the WP Shamsi WordPress plugin versions 4.1.1 and below. It is an authenticated plugin setting change vulnerability that allows any authenticated users, including subscribers, to modify plugin settings due to missing authorization checks (WPScan).

The vulnerability is classified as a Broken Access Control issue (OWASP Top 10 A5) with a CVSS score of 4.3 (medium). It is categorized under CWE-862, indicating a lack of authorization mechanisms. The technical root cause is the absence of proper authorization checks when updating plugin settings (WPScan).

The vulnerability allows any authenticated user with subscriber-level access or higher to modify the plugin's settings, potentially affecting the website's functionality and security. This unauthorized access to plugin settings could lead to unauthorized changes in the website's configuration (WPScan).

The vulnerability has been fixed in WP Shamsi version 4.2.0. Users are advised to update to this version or later to mitigate the security risk. The plugin has since been closed as of July 18, 2023, due to security issues (WordPress).