CVE-2023-33327: 
WordPress vulnerability analysis and mitigation

CVE-2023-33327 is a Privilege Escalation vulnerability affecting the WordPress Leyka plugin versions through 3.30.2. The vulnerability was discovered by Nguyen Anh Tien and was published on May 22, 2023. This security issue is present in Teplitsa of social technologies Leyka plugin and allows unauthorized privilege escalation (Patchstack).

The vulnerability is classified as an Improper Privilege Management (CWE-269) issue. It has received a CVSS v3.1 Base Score of 8.8 (HIGH) with the following vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. This indicates that the vulnerability can be exploited over the network, requires low attack complexity, needs low privileges, requires no user interaction, and can result in high impacts to confidentiality, integrity, and availability (Patchstack).

The vulnerability could allow a malicious actor to escalate their low privileged account to one with higher privileges. If successful, attackers could potentially gain full control of the website if high privileges are obtained (Patchstack).

The vulnerability requires a Subscriber level privilege to exploit. Due to its high CVSS score of 8.8, this vulnerability is considered highly dangerous and is expected to become mass exploited (Patchstack).

The vulnerability has been fixed in version 3.30.3 of the Leyka plugin. Users are advised to update to version 3.30.3 or later immediately to resolve the vulnerability. Patchstack has also issued a virtual patch to mitigate this issue by blocking any attacks until users can update to a fixed version (Patchstack).