CVE-2023-5712: 
WordPress vulnerability analysis and mitigation

CVE-2023-5712 affects the System Dashboard plugin for WordPress in versions up to and including 2.8.7. The vulnerability was disclosed on December 6, 2023, and stems from a missing capability check on the sd_global_value() function hooked via an AJAX action (NVD).

The vulnerability is classified as a Missing Authorization issue (CWE-862) with a CVSS v3.1 base score of 4.3 (Medium). The security flaw exists in the sd_global_value() function which lacks proper capability checks when accessed through AJAX actions. This implementation oversight allows authenticated users with subscriber-level privileges or higher to access the function (Wordfence).

The vulnerability enables authenticated attackers with subscriber-level access or higher to retrieve sensitive global value information from the WordPress installation. This unauthorized access to data could potentially expose sensitive configuration settings or system information (NVD).

The vulnerability requires authentication with at least subscriber-level access to exploit. The attack complexity is considered low as it involves accessing an AJAX endpoint without proper authorization checks (Wordfence).

Users should update their System Dashboard plugin to version 2.8.8 or later, which includes a patch for this vulnerability. The fix implements proper capability checks for the sd_global_value() function (WordPress Plugin).