CVE-2023-51687: 
WordPress vulnerability analysis and mitigation

A Sensitive Data Exposure vulnerability (CVE-2023-51687) was discovered in impleCode's Product Catalog Simple WordPress plugin affecting versions up to 1.7.6. The vulnerability was reported by Muhammad Daffa on November 9, 2023, and was publicly disclosed on December 27, 2023 (Patchstack Database).

The vulnerability is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). It received varying CVSS scores, with the NVD assigning a HIGH severity score of 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), while Patchstack rated it as MEDIUM severity with a score of 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). The vulnerability can be exploited without authentication (NVD).

This vulnerability could allow malicious actors to access sensitive information that is normally restricted from regular users. The exposed data could potentially be used as a stepping stone to exploit other weaknesses in the system (Patchstack Database).

The vulnerability requires no authentication to exploit, making it accessible to unauthenticated attackers. However, Patchstack has classified it as having a low patch priority, suggesting that while the vulnerability exists, it is unlikely to be exploited (Patchstack Database).

The vulnerability has been fixed in version 1.7.7 of the Product Catalog Simple plugin. Users are advised to update to version 1.7.7 or later to remediate this security issue (Patchstack Database).