CVE-2023-5417: 
WordPress vulnerability analysis and mitigation

The Funnelforms Free plugin for WordPress (versions up to and including 3.4) contains a vulnerability identified as CVE-2023-5417. The vulnerability stems from a missing capability check on the fnsf_update_category function, which allows authenticated attackers with subscriber-level permissions or higher to modify Funnelforms categories for any given post ID (NVD).

The vulnerability is classified as a Missing Authorization issue (CWE-862) with a CVSS v3.1 base score of 4.3 (Medium). The attack vector is network-based (AV:N) with low attack complexity (AC:L), requiring low privileges (PR:L) and no user interaction (UI:N). The scope is unchanged (S:U) with no impact on confidentiality (C:N), low impact on integrity (I:L), and no impact on availability (A:N) (NVD, Wordfence).

The vulnerability allows authenticated attackers with subscriber-level permissions or higher to perform unauthorized modifications of Funnelforms categories for any post ID, potentially affecting the content organization and structure of the website (NVD).

The vulnerability requires authentication with at least subscriber-level permissions, making it exploitable by any authenticated user on the WordPress installation (NVD).

A patch has been released to address this vulnerability. Website administrators should update their Funnelforms Free plugin to a version newer than 3.4 (Wordpress Patch).