CVE-2023-0522: 
WordPress vulnerability analysis and mitigation

The Enable/Disable Auto Login when Register WordPress plugin through version 1.1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability. The vulnerability was discovered and publicly disclosed on April 17, 2023, and was assigned CVE-2023-0522. This security flaw affects the plugin's settings update functionality (WPScan).

The vulnerability stems from the absence of CSRF protection mechanisms when updating the plugin's settings. It has been classified as CWE-352 and received a CVSS score of 4.3 (medium severity). The vulnerability falls under the OWASP Top 10 category A2: Broken Authentication and Session Management (WPScan).

An attacker could potentially exploit this vulnerability to modify the plugin's settings by tricking an authenticated administrator into performing unwanted actions. This could lead to unauthorized changes in the auto-login functionality of the WordPress installation (WPScan).

A proof of concept exists demonstrating how the vulnerability can be exploited using a fetch request to the plugin's settings page. The attack can be executed by sending a specially crafted POST request to '/wp-admin/options-general.php?page=auto_login_when_register_setting' with specific parameters (WPScan).

As of the vulnerability disclosure, there is no known fix available for this security issue. Users of the affected plugin should consider implementing additional security measures or potentially removing the plugin until a patch is released (WPScan).