CVE-2023-44142: 
WordPress vulnerability analysis and mitigation

The Inactive Logout WordPress plugin, versions up to and including 3.2.2, contains a Missing Authorization vulnerability identified as CVE-2023-44142. The vulnerability was discovered by researcher Elliot and publicly disclosed on September 20, 2023. This security issue affects the plugin's authorization mechanisms, potentially allowing unauthorized access to certain plugin functionalities (WPScan, Patchstack).

The vulnerability stems from a missing capability check in the ina_reset_adv_settings() function. It has been assigned a CVSS v3.1 score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L. The issue is classified under CWE-862 (Missing Authorization) and falls into the OWASP Top 10 category A5: Broken Access Control (WPScan, Patchstack).

The vulnerability allows authenticated attackers with subscriber-level access or higher to reset the plugin's settings without proper authorization. This could lead to unauthorized modification of data and potential disruption of the plugin's functionality (WPScan).

The vulnerability requires an authenticated user with at least subscriber-level privileges to exploit. The attack complexity is considered low, requiring network access but no user interaction (Patchstack).

The vulnerability has been fixed in version 3.2.3 of the Inactive Logout plugin. Users are advised to update to this version or later to resolve the security issue. Additionally, Patchstack has issued a virtual patch to mitigate this issue by blocking potential attacks until users can update to the fixed version (Patchstack).