CVE-2023-5417: 
WordPress vulnerability analysis and mitigation

The Funnelforms Free plugin for WordPress (versions up to and including 3.4) contains a vulnerability identified as CVE-2023-5417. The vulnerability stems from a missing capability check on the fnsfupdatecategory function, which allows authenticated attackers with subscriber-level permissions or higher to modify Funnelforms categories for any given post ID (NVD).

The vulnerability is classified as a Missing Authorization issue (CWE-862) with a CVSS v3.1 base score of 4.3 (Medium). The attack vector is network-based (AV:N) with low attack complexity (AC:L), requiring low privileges (PR:L) and no user interaction (UI:N). The scope is unchanged (S:U) with no impact on confidentiality (C:N), low impact on integrity (I:L), and no impact on availability (A:N) (NVD, Wordfence).

The vulnerability allows authenticated attackers with subscriber-level permissions or higher to perform unauthorized modifications of Funnelforms categories for any post ID, potentially affecting the content organization and structure of the website (NVD).

A patch has been released to address this vulnerability. Website administrators should update their Funnelforms Free plugin to a version newer than 3.4 (Wordpress Patch).