CVE-2023-46197: 
WordPress vulnerability analysis and mitigation

The vulnerability CVE-2023-46197 affects the WordPress plugin Popup by Supsystic versions 1.10.19 and below. This security issue was discovered by Rafshanzani Suhada and was publicly disclosed on October 18, 2023. The vulnerability is classified as a Missing Authorization to Sensitive Information Exposure issue (Patchstack).

The vulnerability has been assigned a CVSS score of 5.3 (Low severity) with the following vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. It is classified as an Arbitrary File Download vulnerability under the OWASP Top 10 category A1: Broken Access Control (Patchstack).

This vulnerability could allow a malicious actor to download any file from the affected website, including potentially sensitive files containing login credentials or backup files. The security issue has been assessed to have a low severity impact and is considered unlikely to be exploited (Patchstack).

The vulnerability can be exploited by unauthenticated users, making it accessible to any potential attacker who can reach the affected website (Patchstack).

The vulnerability has been fixed in version 1.10.20 of the Popup by Supsystic plugin. Users are advised to update to this version or later to remove the vulnerability. Additionally, Patchstack has issued a virtual patch to mitigate this issue by blocking any attacks until users can update to a fixed version (Patchstack).