CVE-2023-6390: 
WordPress vulnerability analysis and mitigation

The WordPress Users plugin version 1.4 and below contains a Cross-Site Request Forgery (CSRF) vulnerability identified as CVE-2023-6390. The vulnerability was discovered by Daniel Ruf and publicly disclosed on January 3, 2024. The issue affects the plugin's settings update functionality, which lacks proper CSRF protection mechanisms (WPScan).

The vulnerability stems from the absence of CSRF protection checks when updating the plugin's settings. This security flaw has been assigned a CVSS score of 4.3 (medium severity) and is classified under CWE-352. The vulnerability falls under the OWASP Top 10 category A2: Broken Authentication and Session Management (WPScan).

An attacker could potentially exploit this vulnerability to make unauthorized changes to the plugin's settings by tricking an authenticated administrator into executing malicious requests. The attack requires the victim to be logged in as an Editor or above role when accessing a specially crafted HTML page (WPScan).

Currently, there is no known fix available for this vulnerability. Users of the WordPress Users plugin version 1.4 and below should consider implementing additional security measures or exploring alternative plugins until a patch is released (WPScan).