CVE-2023-0331: 
WordPress vulnerability analysis and mitigation

The Correos Oficial WordPress plugin through version 1.2.0.2 contains a critical security vulnerability identified as CVE-2023-0331. The vulnerability was discovered and publicly disclosed on January 31, 2023. This security flaw affects the plugin's file handling mechanism, specifically impacting WordPress installations using the Correos Oficial plugin with WooCommerce dependency (WPScan).

The vulnerability stems from a lack of proper authorization checks and user input validation when generating file paths. It has been assigned a CVSS score of 8.6 (High), and is classified under CWE-552. The vulnerability is categorized as a FILE DOWNLOAD type and falls under the OWASP Top 10 category A1: Injection (WPScan).

This vulnerability allows unauthenticated attackers to download arbitrary files from the server, potentially exposing sensitive information such as configuration files and other critical system data. The ability to access arbitrary files could lead to exposure of sensitive information, including database credentials and other configuration details (CVE Mitre, WPScan).

As of the vulnerability disclosure, there is no known fix available for this security issue. Users of the Correos Oficial WordPress plugin should consider removing or disabling the plugin until a security patch is released (WPScan).