CVE-2023-35044: 
WordPress vulnerability analysis and mitigation

A Cross-Site Request Forgery (CSRF) vulnerability was identified in Drew Phillips Securimage-WP plugin versions 3.6.16 and below. The vulnerability was discovered by Abdi Pranata and was publicly disclosed on June 13, 2023. The issue was assigned CVE-2023-35044 and affects the WordPress plugin Securimage-WP (Patchstack).

The vulnerability stems from inadequate request verification where the plugin does not properly implement nonce verification for certain operations. It has been assigned a CVSS v3.1 score of 4.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. The vulnerability is classified under CWE-352 (Cross-Site Request Forgery) and falls under the OWASP Top 10 category A5: Broken Access Control (WPScan, Patchstack).

The vulnerability could allow malicious actors to force higher privileged users to execute unwanted actions under their current authentication. The severity is considered low, and the vulnerability is unlikely to be exploited according to the assessment (Patchstack).

Currently, there is no official fix available for this vulnerability. The issue affects versions 3.6.16 and below of the Securimage-WP plugin (Patchstack).