CVE-2023-0443: 
WordPress vulnerability analysis and mitigation

CVE-2023-0443 affects the AnyWhere Elementor WordPress plugin versions before 1.2.8. The vulnerability was discovered and disclosed on May 2, 2023, and involves the exposure of a Freemius Secret Key (WPScan).

The vulnerability exists in the includes/pro.php file where a Freemius Secret Key was exposed. This sensitive data exposure has been assigned a CVSS score of 5.3 (medium) and is classified under CWE-200. The vulnerability aligns with OWASP Top 10 category A3: Sensitive Data Exposure (WPScan).

An attacker could potentially exploit this vulnerability by using the exposed Freemius Secret Key to purchase pro subscriptions using test credit card numbers without making actual payments. The compromised key has since been revoked to prevent unauthorized access (WPScan).

The vulnerability was discovered by security researcher Sanjay Das and has been verified. The exposed secret key could be directly accessed through the plugin's source code in the pro.php file (WPScan).

The vulnerability has been patched in version 1.2.8 of the AnyWhere Elementor plugin. Users are advised to update to this version or later to protect against potential exploitation. Additionally, the compromised Freemius Secret Key has been revoked as a security measure (WPScan).