CVE-2023-41130: 
WordPress vulnerability analysis and mitigation

The Premmerce User Roles plugin for WordPress contains a Missing Authorization vulnerability (CVE-2023-41130) discovered in versions up to and including 1.0.12. The vulnerability was publicly disclosed on August 24, 2023, and was discovered by security researcher Nguyen Xuan Chien (WPScan, Patchstack).

The vulnerability stems from missing capability and nonce checks on the 'createRole', 'updateRole', and 'deleteRole' functions. It has been assigned a CVSS score of 8.1-8.3 (High), indicating its severe nature. The vulnerability is classified under OWASP Top 10 category A5: Broken Access Control and CWE-862 (WPScan, Patchstack).

The vulnerability allows authenticated attackers with subscriber-level access and above to create, modify, and delete custom roles within WordPress installations. This could lead to unauthorized modification of data and potential loss of data (WPScan).

The vulnerability has been patched in version 1.0.13 of the Premmerce User Roles plugin. Site administrators are strongly advised to update to this version or later to resolve the vulnerability. Additionally, Patchstack has issued a virtual patch to mitigate this issue by blocking potential attacks until users can update to the fixed version (Patchstack).