CVE-2023-51477: 
WordPress vulnerability analysis and mitigation

The BuddyBoss Theme for WordPress contains a Missing Authorization vulnerability (CVE-2023-51477) discovered by Dave Jong. The vulnerability affects all versions up to and including 2.4.60, and was publicly disclosed on December 27, 2023. This security issue stems from improper authentication and missing capability checks in unspecified functions (WPScan).

The vulnerability is classified as a Broken Access Control issue (OWASP Top 10 A5) and is identified under CWE-862. It received a CVSS score of 5.3 (Medium) according to some sources, while others rate it at 9.8 (High). The security flaw exists due to missing capability checks on certain functions within the theme (WPScan, Patchstack).

The vulnerability allows unauthenticated attackers to modify the plugin's settings and make arbitrary changes to WordPress settings. This represents a significant security risk as it could lead to unauthorized modifications of critical site configurations (Patchstack).

According to security researchers, this vulnerability is known to be exploited in the wild and is considered highly dangerous with an expectation of mass exploitation (Patchstack).

The vulnerability has been patched in version 2.4.61 of the BuddyBoss Theme. Site administrators are strongly advised to update to this version or later immediately. For sites unable to update immediately, virtual patching solutions are available through security providers to mitigate the risk (Patchstack).