CVE-2022-4943: 
WordPress vulnerability analysis and mitigation

The miniOrange's Google Authenticator plugin for WordPress (versions up to and including 5.6.5) was identified with CVE-2022-4943, a vulnerability related to missing authorization checks when changing plugin settings. This security flaw was publicly disclosed on April 19, 2023, and allows unauthenticated attackers to modify the plugin's configuration (NVD Database, WPScan).

The vulnerability is classified as CWE-862 (Missing Authorization) and received a CVSS v3.1 base score of 7.5 (High) from Wordfence and 5.3 (Medium) from NIST. The core issue stems from the absence of proper capability checks when modifying plugin settings, which bypasses the intended authorization mechanisms (NVD Database).

The vulnerability allows unauthenticated attackers to change the plugin's settings, potentially compromising the two-factor authentication security measures implemented through the plugin. This could lead to unauthorized access to protected WordPress installations (NVD Database).

The vulnerability was fixed in version 5.6.6 of the miniOrange's Google Authenticator plugin. Users are strongly advised to update to this version or newer to protect against potential exploitation (WPScan).