CVE-2023-48779: 
WordPress vulnerability analysis and mitigation

A Missing Authorization vulnerability was discovered in the 360 Javascript Viewer WordPress plugin versions 1.7.11 and below. The vulnerability was reported by Abdi Pranata on June 15, 2023, and was publicly disclosed on November 28, 2023. This security issue was assigned CVE-2023-48779 with a CVSS score of 6.5 (High) (Patchstack).

The vulnerability is classified as a Broken Access Control issue, which stems from missing authorization, authentication, or nonce token checks in certain functions. This security flaw could potentially allow unprivileged users to execute actions typically reserved for users with higher privileges (Patchstack).

This vulnerability is considered highly dangerous and is expected to become mass exploited. The issue falls under the OWASP Top 10 category A5: Broken Access Control, indicating its significant security implications (Patchstack).

The vulnerability can be exploited by unauthenticated users, making it particularly concerning. Hackers typically automate attacks against such vulnerabilities to compromise as many websites as possible before users have time to implement patches and updates (Patchstack).

The vulnerability has been fixed in version 1.7.12 of the 360 Javascript Viewer plugin. Users are strongly advised to update to version 1.7.12 or later immediately. Additionally, Patchstack has issued a virtual patch to mitigate this issue by blocking potential attacks until users can update to the fixed version (Patchstack).