CVE-2023-47788: 
WordPress vulnerability analysis and mitigation

The CVE-2023-47788 is a Missing Authorization vulnerability affecting Automattic's Jetpack WordPress plugin versions before 12.7. The vulnerability was discovered by Rafie Muhammad and publicly disclosed on November 16, 2023. The issue specifically affects the WPCom External Media REST permission_callback function in versions up to and including 12.6.2 (Patchstack, WPScan).

The vulnerability is classified as a Missing Authorization (CWE-862) issue with a CVSS v3.1 base score of 4.3 (Medium), with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L. The security flaw stems from a missing capability check in the WPCom External Media REST permission_callback function, which allows authenticated users with contributor-level access to perform actions beyond their intended privileges (Patchstack).

The vulnerability allows authenticated attackers with contributor-level access and above to import external media even without having the upload_files capability, which represents a broken access control issue (WPScan).

The vulnerability requires an authenticated user with at least contributor-level access to exploit. The attack complexity is considered low, requiring low privileges and no user interaction (Patchstack).

The vulnerability has been fixed in Jetpack version 12.7. Users are advised to update to this version or later to remediate the security issue (Patchstack).