CVE-2023-51672: 
WordPress vulnerability analysis and mitigation

CVE-2023-51672 is a Missing Authorization vulnerability affecting FunnelKit Checkout WordPress plugin versions through 3.10.3. The vulnerability was discovered by Dave Jong and publicly disclosed on December 27, 2023. This security issue impacts the FunnelKit Checkout plugin, which is a WordPress extension (Patchstack, WPScan).

The vulnerability is classified as CWE-862 (Missing Authorization) and has received varying CVSS scores from different sources. Patchstack assigned it a CVSS v3.1 score of 7.5 (High) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, while other sources like WPScan rated it at 6.5 (Medium). The issue stems from a missing capability check on an unknown function, which fails to properly validate user authorization (Patchstack).

The vulnerability allows unauthenticated attackers to delete arbitrary content from the affected WordPress installation, including posts, pages, and other content types. This can result in significant data loss and disruption to the website's operation (Patchstack).

The vulnerability is considered highly dangerous and expected to become mass exploited. It requires no authentication (unauthenticated attack vector) and has low attack complexity, making it particularly concerning for website owners (Patchstack).

The vulnerability has been fixed in FunnelKit Checkout version 3.11.0. Website administrators are strongly advised to update to this version or later immediately. For users unable to update immediately, Patchstack has issued a virtual patch to mitigate this issue by blocking potential attacks (Patchstack).