CVE-2023-51482: 
WordPress vulnerability analysis and mitigation

The CVE-2023-51482 is an Improper Authentication vulnerability affecting EazyPlugins Eazy Plugin Manager versions through 4.1.2. The vulnerability allows unauthorized access to functionality not properly constrained by Access Control Lists (ACLs). This security issue was discovered and reported by Rafie Muhammad from Patchstack on November 24, 2023, and was publicly disclosed on December 27, 2023 (Patchstack Database).

The vulnerability has been assigned a CVSS v3.1 base score of 9.9 (Critical) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. The weakness is categorized under CWE-287 (Improper Authentication). The vulnerability allows users with subscriber-level privileges to perform unauthorized settings changes that could potentially lead to Remote Code Execution (RCE) (Patchstack Database).

This vulnerability is considered highly dangerous and expected to become mass exploited. It allows attackers with subscriber-level access to perform unauthorized settings changes that could potentially lead to Remote Code Execution (RCE), giving them complete control over the affected WordPress installation (Patchstack Database).

The vulnerability requires a low level of access (subscriber privileges) and has been classified as having low attack complexity, making it relatively easy to exploit. No user interaction is required for exploitation, and the attack can be performed remotely (Patchstack Database).

The vulnerability has been fixed in version 4.1.3 of the Eazy Plugin Manager plugin. Users are strongly advised to update to this version or later immediately. For users unable to update immediately, Patchstack has issued a virtual patch to mitigate this issue by blocking potential attacks (Patchstack Database).