CVE-2023-51481: 
WordPress vulnerability analysis and mitigation

CVE-2023-51481 is a vulnerability affecting the powerfulwp Local Delivery Drivers for WooCommerce WordPress plugin through version 1.9.0. The vulnerability was discovered by Rafie Muhammad and publicly disclosed on December 27, 2023. This security issue is classified as an Improper Privilege Management vulnerability that allows for privilege escalation and unauthorized account takeover (Patchstack).

The vulnerability stems from a missing capability check on the 'lddfw_edit_driver_service' function, which allows unauthenticated attackers to access and modify data. It has been assigned CWE-269 (Improper Privilege Management) and received a CVSS v3.1 base score of 9.8 (CRITICAL) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (WPScan, Patchstack).

The vulnerability enables unauthenticated attackers to take over driver accounts within the WooCommerce system. This security flaw could potentially allow malicious actors to escalate their privileges from a low-privileged account to one with higher privileges, potentially leading to full control of the website if high-level privileges are obtained (Patchstack).

The vulnerability is considered highly dangerous and expected to become mass exploited. It requires no authentication to exploit, has low attack complexity, and needs no user interaction, as indicated by its CVSS score of 9.8 (Patchstack).

The vulnerability has been fixed in version 1.9.1 of the Local Delivery Drivers for WooCommerce plugin. Users are strongly advised to update to version 1.9.1 or later immediately. Patchstack has issued a virtual patch to mitigate this issue by blocking attacks until users can update to the fixed version (Patchstack).