CVE-2023-6077: 
WordPress vulnerability analysis and mitigation

CVE-2023-6077 affects the Slider WordPress plugin versions before 3.5.12. The vulnerability was discovered and reported by Krzysztof Zając from CERT PL, and was publicly disclosed on November 23, 2023. This security issue impacts the WordPress plugin 'Ultimate Responsive Image Slider' and has been assigned a CVSS score of 6.5 (MEDIUM) (NVD).

The vulnerability stems from improper access control in the AJAX action 'uris_get_thumbnail'. The plugin fails to verify if the posts being accessed via this AJAX action are slides and whether the requesting user has appropriate permissions to view them. This implementation flaw has been classified as CWE-862 (Missing Authorization) and falls under the OWASP Top 10 category A5: Broken Access Control (WPScan).

The vulnerability allows any authenticated user, including those with subscriber-level privileges, to access arbitrary posts including private, draft, and password-protected content. This represents a significant breach of content confidentiality as it bypasses WordPress's built-in access controls (WPScan).

Users are advised to update their Ultimate Responsive Image Slider plugin to version 3.5.12 or later, which contains the fix for this vulnerability (WPScan).