CVE-2023-50850: 
WordPress vulnerability analysis and mitigation

A Missing Authorization vulnerability was discovered in WooCommerce Subscriptions plugin versions below 5.8.0. The vulnerability was identified by researcher Rafie Muhammad and publicly disclosed on January 17, 2024. This security issue affects the plugin's access control mechanisms and has been assigned CVE-2023-50850 (WPScan, Patchstack).

The vulnerability stems from a missing capability check on a low-severity function within the WooCommerce Subscriptions plugin. It has been classified as a Broken Access Control issue (OWASP Top 10 A5) and assigned CWE-862. The vulnerability received a CVSS score of 4.3 (medium severity) (WPScan, Patchstack).

The vulnerability allows authenticated attackers with contributor-level access and above to potentially access or modify data through the affected function due to improper authorization controls (WPScan).

The security issue has been assessed as having a low severity impact and is considered unlikely to be exploited. The vulnerability requires an authenticated user with at least contributor-level privileges to exploit (Patchstack).

The vulnerability has been fixed in WooCommerce Subscriptions version 5.8.0. Users are advised to update to version 5.8.0 or later to remediate this security issue (Patchstack).