CVE-2023-47874: 
WordPress vulnerability analysis and mitigation

The Perfmatters WordPress plugin contained a Missing Authorization vulnerability, identified as CVE-2023-47874. The vulnerability affected all versions of Perfmatters up to and including version 2.1.6, and was discovered by security researcher Dave Jong. The issue was publicly disclosed on November 20, 2023, and has since been fixed in version 2.1.7 (WPScan, Patchstack).

The vulnerability is classified as a Broken Access Control issue (OWASP Top 10 A5) with a CVSS score of 5.3-5.4 (medium severity). The security flaw stems from a missing capability check on one of the plugin's functions, which failed to properly implement authorization controls. The vulnerability is categorized under CWE-862, relating to Missing Authorization (WPScan, Patchstack).

The vulnerability allows subscriber-level attackers to invoke privileged functions, potentially leading to unauthorized access, modification, or loss of data. The issue is considered moderately dangerous and is expected to become exploited (Patchstack).

The vulnerability requires an attacker to have at least a subscriber-level account on the WordPress installation. The exploit can be executed by users with minimal privileges to perform actions that should be restricted to users with higher privilege levels (WPScan).

The recommended mitigation is to update the Perfmatters plugin to version 2.1.7 or later, which contains the fix for this vulnerability. For users unable to update immediately, Patchstack has issued a virtual patch to mitigate this issue by blocking potential attacks until the update can be applied (Patchstack).