CVE-2023-47771: 
WordPress vulnerability analysis and mitigation

The Essential Grid plugin for WordPress contains a Missing Authorization vulnerability (CVE-2023-47771) affecting versions up to and including 3.0.18. The vulnerability was discovered by Rafie Muhammad and publicly disclosed on November 14, 2023. This security issue impacts the plugin's functionality due to missing capability checks on several functions (WPScan).

The vulnerability is classified as a Broken Access Control issue with a CVSS score of 8.3 (High). The security flaw stems from missing capability checks on several functions, which allows authenticated users with subscriber-level access and above to access functionality intended for higher privileged users (Patchstack).

The vulnerability allows authenticated attackers with subscriber-level access to perform actions intended for higher privileged users. While the exact consequences are not fully documented, this type of access control bypass could potentially lead to unauthorized administrative actions (WPScan).

The vulnerability requires authentication with at least subscriber-level access to exploit. Given the CVSS score of 8.3, it is considered highly dangerous and expected to become mass exploited (Patchstack).

The vulnerability has been fixed in version 3.0.19 of the Essential Grid plugin. Site administrators are strongly advised to update to this version or later to resolve the security issue (WPScan).